資安事件新聞週報 2021/12/27 ~ 2021/12/31

 資安事件新聞週報 2021/12/27  ~  2021/12/31

1.重大弱點漏洞/後門/Exploit/Zero Day
駭客利用漏洞攻入使用 AMD EPYC 的 HP 伺服器進行挖礦， 8 天獲利超過 10 萬美金
https://www.cool3c.com/article/170421

apache    http_server CVE-2021-44790
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44790

Nvidia、HPE、IBM公布受Log4j漏洞影響的產品
https://www.ithome.com.tw/news/148586

New Apache Log4j Update Released to Patch Newly Discovered Vulnerability
https://thehackernews.com/2021/12/new-apache-log4j-update-released-to.html

Apache Log4j爆發近十年最大漏洞，微軟、蘋果都受波及
https://www.techbang.com/posts/92910-f-secure-incident-response-guidance-log4j-2-vulnerability

利用 Log4j Java 嚴重零日漏洞發動的勒索攻擊已被發現
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9637

中國駭客組織疑使用 Log4j 漏洞進行攻擊
https://unwire.pro/2021/12/30/china-based-group-used-log4j-flaw-in-attack/security/

未及時向中國政府通報Log4j漏洞，阿里雲稱未意識漏洞嚴重性
https://times.hinet.net/news/23678474

Apache HTTP伺服器存在安全漏洞：CVE-2021-44224與44790
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9647

Apache Log4j2 2.14.1 - Information Disclosure
https://www.exploit-db.com/exploits/50590

資安事件新聞週報 2021/12/20 ~ 2021/12/24

 資安事件新聞週報 2021/12/20  ~  2021/12/24

1.重大弱點漏洞/後門/Exploit/Zero Day
未獲即時通知Log4j漏洞，中國工信部暫停與阿里巴巴合作
https://www.ithome.com.tw/news/148540

Apache Log4j更新修補程式後仍存在漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9630

Critical Apache Log4j (Log4Shell) Vulnerability Updates
https://reurl.cc/q19Yp0

Apache Log4j2 2.0-beta9 到 2.12.1 和 2.13.0 到 2.15.0
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44228

Apache 已發布 Apache HTTP Server 的安全更新
https://httpd.apache.org/security/vulnerabilities_24.html

Fortinet FortiNAC 中存在安全弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-43065
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-41021

Fortinet FortiOS 存在輸入驗證錯誤弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-26109

Fortinet FortiWeb 存在安全弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-41025
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-36195

資安事件新聞週報 2021/12/13 ~ 2021/12/17

 資安事件新聞週報 2021/12/13  ~  2021/12/17

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布更新以解決Apache HTTP Server 的安全性弱點
https://reurl.cc/0x7RWb

資安專家發現多個 Wi-Fi、藍牙晶片內漏洞，可導致駭侵者竊取密碼與資料
https://www.twcert.org.tw/tw/cp-104-5393-142c3-1.html

白帽駭客直接在網路公開微軟Windows 11高危險漏洞，只因懸賞獎金打骨折
https://www.techbang.com/posts/92140-microsoft-windows-11-high-risk-vulnerability-was-publicly

Windows曝零日漏洞遭駭客利用散播木馬病毒！微軟釋出12月安全更新
https://3c.ltn.com.tw/news/47058

微軟、蘋果都受波及！日誌框架Apache Log4j爆漏洞，堪稱近10年最大資安威脅
https://www.bnext.com.tw/article/66743/log4j-cybersecurity

Apache Log4j驚爆近年最嚴重漏洞，殃及蘋果、微軟、推特重要服務，連美國國安局都受影響
https://www.ithome.com.tw/news/148332

Apache Log4j漏洞開採活動早在官方公布9天前便開始，現已大舉展開
https://times.hinet.net/news/23656228

10年來最嚴重資安漏洞波及全球！微軟：曾被中國、伊朗駭客利用 
https://m.match.net.tw/pc/news/technology/20211216/6271266

資安事件新聞週報 2021/12/6 ~ 2021/12/10

 資安事件新聞週報 2021/12/6  ~  2021/12/10

1.重大弱點漏洞/後門/Exploit/Zero Day
Over 300,000 MikroTik Devices Found Vulnerable to Remote Hacking Bugs
https://thehackernews.com/2021/12/over-300000-mikrotik-devices-found.html

Grafana 8.3.0 - Directory Traversal and Arbitrary File Read
https://www.exploit-db.com/exploits/50581

多款家用路由器發現資安漏洞，國內廠商已釋出更新檔，建議用戶盡速進行更新
https://reurl.cc/RbNZXG

資安公司對9款熱門家用路由器實測共發現226個漏洞，建議更換預設密碼
https://www.techbang.com/posts/92344-9-popular-home-routers-tested-a-total-of-226-vulnerabilities

SonicWall Urges Customers to Immediately Patch Critical SMA 100 Flaws
https://thehackernews.com/2021/12/sonicwall-urges-customers-to.html

SonicWall之SMA 100系列SSL VPN設備存在多個安全漏洞(CVE-2021-20038~20045)
https://www.nccst.nat.gov.tw/VulnerabilityDetail?lang=zh&seq=1193

資安事件新聞週報 2021/11/29 ~ 2021/12/04

 資安事件新聞週報 2021/11/29  ~  2021/12/04

1.重大弱點漏洞/後門/Exploit/Zero Day
多款HP雷射印表機、多功能事務機及掃描器存在安全漏洞(CVE-2021-39237與CVE-2021-39238)，
允許遠端攻擊者執行任意程式碼
https://www.nccst.nat.gov.tw/VulnerabilityDetail?lang=zh&seq=1192

Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)
https://www.exploit-db.com/exploits/50512

ASUS ROG Rapture GT-AX11000、RT-AX3000、RT-AX55、RT-AX56U、
RT-AX56U_V2、RT-AX58U、RT-AX82U、RT-AX82U GUNDAM EDITION、
RT-AX86系列（ RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION,
RT-AX88U, RT-AX92U, TUF Gaming AX3000,
TUF Gaming AX5400 (TUF-AX5400), ASUS Zen0WiFi XD6,
ASUS ZenWiFi AX (XT8) 3. 0.4.386.45898 和 3.0.0.4.386.45911
(含)之前 RT-AX68U 允許未經身份驗證的遠端攻擊者透過發送特製的 HTTP 數據包進行 DoS。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-41436
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-41435

Dell EMC CloudLink 7.1 (含)之前版本，有硬編碼密碼漏洞。
硬編碼憑證的遠端高特權攻擊者，可能會利用此弱點未經授權訪問系統。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-36312
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-36313
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-36314

Networking OS10（2021 年 10 月之前啟用了 RESTCONF API 的版本）包含一個權限提升弱點。
對 API 具有特定訪問權限的惡意低權限用戶可能會利用此弱點獲得受影響系統的管理員權限。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-36307
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-36308
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-36306

資安事件新聞週報 2021/11/22 ~ 2021/11/26

 資安事件新聞週報 2021/11/22  ~  2021/11/26

1.重大弱點漏洞/後門/Exploit/Zero Day
Eavesdropping Bugs in MediaTek Chips Affect 37% of All Smartphones and IoT Globally
https://thehackernews.com/2021/11/eavesdropping-bugs-in-mediatek-chips.html

聯發科晶片遭曝資安漏洞，逾三成Android手機恐受影響！ 官方釋出修補
https://3c.ltn.com.tw/news/46805

聯發科手機SoC存資安疑慮？ 聯發科：已排除問題
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000624283_ZJ415EJQ9SAV232RI8H6O&cf=A21

聯發科平台傳出竊聽安全漏洞，不過在未傳出實際攻擊前已被修復
https://www.cool3c.com/article/168994

資安公司揭聯發科晶片漏洞！37%安卓手機、IoT設備用戶面臨竊聽風險
https://www.bnext.com.tw/article/66376/mediatek-cybersecurity-soc

600 萬台英國 Sky 寬頻用戶端路由器的資安漏洞，修復期間長達 17 個月
https://www.twcert.org.tw/tw/cp-104-5331-12ade-1.html

資安事件新聞週報 2021/11/15 ~ 2021/11/19

 資安事件新聞週報 2021/11/15  ~  2021/11/19

1.重大弱點漏洞/後門/Exploit/Zero Day
美、英、澳共同發聲：伊朗駭客正在開採微軟Exchange及Fortinet漏洞
https://www.ithome.com.tw/news/147916

GitHub修補可讓駭客更新任何套件的Npm漏洞
https://www.ithome.com.tw/news/147896

New Blacksmith Exploit Bypasses Current Rowhammer Attack Defenses
https://thehackernews.com/2021/11/new-blacksmith-exploit-bypasses-current.html

Hackers Exploit macOS Zero-Day to Hack Hong Kong Users with new Implant
https://thehackernews.com/2021/11/hackers-exploit-macos-zero-day-to-hack.html

FBI Issues Flash Alert on Actively Exploited FatPipe VPN Zero-Day Bug
https://thehackernews.com/2021/11/fbi-issues-flash-alert-on-actively.html

資安事件新聞週報 2021/11/8 ~ 2021/11/12

 資安事件新聞週報 2021/11/8  ~  2021/11/12

1.重大弱點漏洞/後門/Exploit/Zero Day
史上第一個能感染一切的漏洞現身，新型態「Trojan Source」供應鏈攻擊來襲
https://technews.tw/2021/11/09/trojan-source-bug-threatens-security-all-code/

Palo Alto Warns of Zero-Day Bug in Firewalls Using GlobalProtect Portal VPN
https://thehackernews.com/2021/11/palo-alto-warns-of-zero-day-bug-in.html

Windows 10老用戶注意！2004版微軟官方支援將於12月這天終止
https://3c.ltn.com.tw/news/46629

Microsoft Issues Patches for Actively Exploited Excel, Exchange Server 0-Day Bugs
https://thehackernews.com/2021/11/microsoft-issues-patches-for-actively.html

微軟Windows作業系統與應用程式存在多個安全漏洞
https://net.nthu.edu.tw/2009/mailing:announcement:20211111_01

資安事件新聞週報 2021/11/1 ~ 2021/11/5

 資安事件新聞週報 2021/11/1  ~  2021/11/5

1.重大弱點漏洞/後門/Exploit/Zero Day
CISA要求美聯邦政府機關限時修補290項高風險軟硬體漏洞
https://www.ithome.com.tw/news/147648

U.S. Federal Agencies Ordered to Patch Hundreds of Actively Exploited Flaws
https://thehackernews.com/2021/11/us-federal-agencies-ordered-to-patch.html

Cisco 近日發布更新以解決多個產品的安全性弱點
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-dir-traversal-95UyW5tk

Sonicwall SonicOS 6.5.4 - 'Common Name' Cross-Site Scripting (XSS)
https://www.exploit-db.com/exploits/50485

phpMyAdmin 4.8.1 - Remote Code Execution (RCE)
https://www.exploit-db.com/exploits/50457

Hardcoded SSH Key in Cisco Policy Suite Lets Remote Hackers Gain Root Access
https://thehackernews.com/2021/11/hardcoded-ssh-key-in-cisco-policy-suite.html

資安事件新聞週報 2021/10/25 ~ 2021/10/29

 資安事件新聞週報 2021/10/25  ~  2021/10/29

1.重大弱點漏洞/後門/Exploit/Zero Day
Oracle Solaris重大零時差漏洞遭駭客開採，曾潛伏企業內長達2年
https://industry4.ithome.com.tw/news/140915

Oracle 近日發布更新以解決多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/10/19/oracle-releases-october-2021-critical-patch-update

Apache發布針對Apache Tomcat的安全公告
http://mail-archives.us.apache.org/mod_mbox/www-announce/202110.mbox/%3C9b8b83e3-7fec-a26d-7780-e5d4a85f7df6%40apache.org%3E

Cisco 近日發布更新以解決Cisco IOS XE SD-WAN 的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/10/21/cisco-releases-security-updates-ios-xe-sd-wan-software

Cisco Releases Security Updates for Multiple Products
https://us-cert.cisa.gov/ncas/current-activity/2021/10/28/cisco-releases-security-updates-multiple-products

資安事件新聞週報 2021/10/18 ~ 2021/10/22

 資安事件新聞週報 2021/10/18  ~  2021/10/22

1.重大弱點漏洞/後門/Exploit/Zero Day
Bug in Popular WinRAR Software Could Let Attackers Hack Your Computer
https://thehackernews.com/2021/10/bug-in-free-winrar-software-could-let.html

Oracle Critical Patch Update Advisory - October 2021
https://reurl.cc/aNevgY

Microsoft Warns of New Security Flaw Affecting Surface Pro 3 Devices
https://thehackernews.com/2021/10/microsoft-warns-of-new-security-flaw.html

微軟要求系統管理員更新 PowerShell，以修補 WDAC 資安防護跳過漏洞
https://reurl.cc/WX0dr9

微軟推出 2021 年 10 月 Patch Tuesday 資安修補包，修復多個嚴重及 0-day
https://reurl.cc/Mk3dDn

OWASP自2017年來首度更新弱點排名Top 10
https://blog.twnic.tw/2021/10/18/20252/

資安事件新聞週報 2021/10/11 ~ 2021/10/15

 資安事件新聞週報 2021/10/11  ~  2021/10/15

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布更新以解決多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/10/07/cisco-releases-security-updates-multiple-products

Micro Focus ArcSight Enterprise Security Manager (ESM)  CVE-2021-38124
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-38124

Trend Micro ServerProtect
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-36745

Apache HTTP伺服器存在安全漏洞(CVE-2021-42013)，允許攻擊者遠端執行任意程式碼
https://www.isda.org.tw/2021/10/09/0a4bf59c2d6b1fc5d36850718f1675f4/

New Patch Released for Actively Exploited 0-Day Apache Path Traversal to RCE Attacks
https://thehackernews.com/2021/10/new-patch-released-for-actively.html

資安事件新聞週報 2021/10/04 ~ 2021/10/08

 資安事件新聞週報 2021/10/04  ~  2021/10/08

1.重大弱點漏洞/後門/Exploit/Zero Day
Apache修補已被開採的資料外洩漏洞
https://www.ithome.com.tw/news/147117

Apache Warns of Zero-Day Exploit in the Wild — Patch Your Web Servers Now
https://thehackernews.com/2021/10/apache-warns-of-zero-day-exploit-in.html

微軟強化伺服器韌體與網路安全
https://www.ithome.com.tw/tech/147018

關於微軟 Azure 安全漏洞 Azurescape，你必須知道的事情
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/C4A67EE8E049422F9B35A5460A7E2988

QNAP QTS 5.0 正式版登場：升級系統核心、強化資安，支援 WireGuard VPN，並內建免費 exFAT 授權
https://reurl.cc/ox723q

資安事件新聞週報 2021/9/27 ~ 2021/10/01

 資安事件新聞週報 2021/9/27  ~  2021/10/01

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布更新以解決多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/09/23/cisco-releases-security-updates-multiple-products

New Azure AD Bug Lets Hackers Brute-Force Passwords Without Getting Caught
https://thehackernews.com/2021/09/new-azure-ad-bug-lets-hackers-brute.html

WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)
https://www.exploit-db.com/exploits/50366

Microsoft Windows cmd.exe - Stack Buffer Overflow
https://www.exploit-db.com/exploits/50331

NETGEAR Releases Security Updates for RCE Vulnerability
https://us-cert.cisa.gov/ncas/current-activity/2021/09/21/netgear-releases-security-updates-rce-vulnerability

資安事件新聞週報 2021/9/20 ~ 2021/9/24

 資安事件新聞週報 2021/9/20  ~  2021/9/24

1.重大弱點漏洞/後門/Exploit/Zero Day
New Nagios Software Bugs Could Let Hackers Take Over IT Infrastructures
https://thehackernews.com/2021/09/new-nagios-software-bugs-could-let.html

VMware 發布多個產品的安全更新
https://us-cert.cisa.gov/ncas/current-activity/2021/09/21/vmware-releases-security-updates

Cisco Releases Patches 3 New Critical Flaws Affecting IOS XE Software
https://thehackernews.com/2021/09/cisco-releases-patches-3-new-critical.html

Netgear 修復多款路由器嚴重漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9470

Netgear 修復多款路由器嚴重漏洞，可導致駭侵者遠端執行任意程式碼
https://www.twcert.org.tw/tw/cp-104-5108-edb59-1.html

Aruba Operating System
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-37724

ArubaOS 存在安全弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-37723
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-37718

蘋果修補舊款裝置的零時差攻擊漏洞
https://www.ithome.com.tw/news/146869

資安事件新聞週報 2021/9/13 ~ 2021/9/17

 資安事件新聞週報 2021/9/13  ~  2021/9/17

1.重大弱點漏洞/後門/Exploit/Zero Day
FBI警告：國家級駭客正在開採Zoho的自助式密碼管理平臺漏洞
https://www.ithome.com.tw/news/146787

Update Google Chrome to Patch 2 New Zero-Day Flaws Under Attack
https://thehackernews.com/2021/09/update-google-chrome-to-patch-2-new.html

Critical Bug Reported in NPM Package With Millions of Downloads Weekly
https://thehackernews.com/2021/09/critical-bug-reported-in-npm-package.html

全景 TSSServiSignAdapter Windows版 - Improper Input Validation
https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html

Third Critical Bug Affects Netgear Smart Switches — Details and PoC Released
https://thehackernews.com/2021/09/third-critical-bug-affects-netgear.html

Critical Flaws Discovered in Azure App That Microsoft Secretly Installs on Linux VMs
https://thehackernews.com/2021/09/critical-flaws-discovered-in-azure-app.html

Cisco 近日發布更新以解決產品 IOS XR Software 的多個安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/09/09/cisco-releases-security-updates-multiple-products

Adobe 已發布安全更新，以解決多個 Adobe 產品中的弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/09/14/adobe-releases-security-updates-multiple-products

Citrix 發布 ShareFile 的安全更新
https://us-cert.cisa.gov/ncas/current-activity/2021/09/14/citrix-releases-security-update-sharefile-storage-zones-controller

資安事件新聞週報 2021/9/6 ~ 2021/9/10

 資安事件新聞週報 2021/9/6  ~  2021/9/10

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 發布Enterprise NFV Infrastructure Software（NFVIS）軟體安全更新
https://us-cert.cisa.gov/ncas/current-activity/2021/09/02/cisco-releases-security-updates-cisco-enterprise-nfvis

多家廠商 SoC 產品中的藍牙堆疊含嚴重 BrakTooth 漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9442

數十億用戶遭殃！　BrakTooth漏洞「透過藍牙」攻擊Android產品
https://finance.ettoday.net/news/2074956

Netgear 修復三個嚴重資安漏洞，影響 20 種智慧型網路交換器
https://blog.twnic.tw/2021/09/11/20052/

研究人員：Windows最新MSHTML漏洞比想像中危險
https://www.ithome.com.tw/news/146650

微軟 IE 渲染引擎爆發零時差漏洞！駭客正用來發動目標式攻擊
https://technews.tw/2021/09/10/microsoft-attackers-exploiting-windows-zero-day-flaw/

CISA Warns of Actively Exploited Zoho ManageEngine ADSelfService Vulnerability
https://thehackernews.com/2021/09/cisa-warns-of-actively-exploited-zoho.html

Moving Forward After CentOS 8 EOL
https://thehackernews.com/2021/09/moving-forward-after-centos-8-eol.html

Critical Auth Bypass Bug Affect NETGEAR Smart Switches — Patch and PoC Released
https://thehackernews.com/2021/09/critical-auth-bypass-bug-affect-netgear.html

資安事件新聞週報 2021/8/30 ~ 2021/9/3

 資安事件新聞週報 2021/8/30  ~  2021/9/3

1.重大弱點漏洞/後門/Exploit/Zero Day
QNAP Working on Patches for OpenSSL Flaws Affecting its NAS Devices
https://thehackernews.com/2021/09/qnap-working-on-patches-for-openssl.html

SUSE併購後的第一個版本，Rancher 2.6大幅強化叢集配置功能
https://www.ithome.com.tw/news/146534

MySQL User-Defined (Linux) x32 / x86_64 - 'sys_exec' Local Privilege Escalation
https://www.exploit-db.com/exploits/50236

Synology DSM 7.0 全面更新 系統、使用者、資料安全性大升級
https://www.cool3c.com/article/164641

SQL Server 2012 & Windows Server 2012 End of Support
https://cloudblogs.microsoft.com/sqlserver/2021/07/14/know-your-options-for-sql-server-2012-and-windows-server-2012-end-of-support/

微軟Exchange爆安全漏洞　黑客未經身分認證可存取郵件
https://reurl.cc/5r76VR

微軟Azure出現重大漏洞，用戶應盡速更新金鑰
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9426

資安事件新聞週報 2021/8/23 ~ 2021/8/27

 資安事件新聞週報 2021/8/23  ~  2021/8/27

1.重大弱點漏洞/後門/Exploit/Zero Day

Cisco 近日發布更新以解決多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/08/19/cisco-releases-security-updates-multiple-products

Cisco Small Business RV110W、RV130、RV130W 和 RV215W 路由器的通用隨插即用 (UPnP) 服務中存在一個漏洞
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-34730

Critical Flaw Discovered in Cisco APIC for Switches — Patch Released
https://thehackernews.com/2021/08/critical-flaw-discovered-in-cisco-apic.html

F5 Releases Critical Security Patch for BIG-IP and BIG-IQ Devices
https://thehackernews.com/2021/08/f5-releases-critical-security-patches.html

VMware Issues Patches to Fix New Flaws Affecting Multiple Products
https://thehackernews.com/2021/08/vmware-issues-patches-to-fix-new-flaws.html

Fortinet FortiWeb產品存在安全漏洞(CVE-2021-22123)
https://net.nthu.edu.tw/2009/mailing:announcement:20210823_01

NetGear D1500 V1.0.0.21_1.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting (XSS)
https://www.exploit-db.com/exploits/50201

SonicWall NetExtender 10.2.0.300 - Unquoted Service Path
https://www.exploit-db.com/exploits/50212

資安事件新聞週報 2021/8/16 ~ 2021/8/20

 資安事件新聞週報 2021/8/16  ~  2021/8/20

1.重大弱點漏洞/後門/Exploit/Zero Day
Unpatched Remote Hacking Flaw Disclosed in Fortinet's FortiWeb WAF
https://thehackernews.com/2021/08/unpatched-remote-hacking-zero-day-flaw.html

Hackers can bypass Cisco security products in data theft attacks
https://www.bleepingcomputer.com/news/security/hackers-can-bypass-cisco-security-products-in-data-theft-attacks/

Critical Flaw Found in Older Cisco Small Business Routers Won't Be Fixed
https://thehackernews.com/2021/08/critical-flaw-found-in-older-cisco.html

Cisco Releases Security Updates for Multiple Products
https://us-cert.cisa.gov/ncas/current-activity/2021/08/19/cisco-releases-security-updates-multiple-products

F5 BIG-IP 多個漏洞
https://www.hkcert.org/tc/security-bulletin/f5-big-ip-multiple-vulnerabilities_20210818

資安事件新聞週報 2021/8/9 ~ 2021/8/13

 資安事件新聞週報 2021/8/9  ~  2021/8/13

1.重大弱點漏洞/後門/Exploit/Zero Day
Pulse Secure VPNs Get New Urgent Update for Poorly Patched Critical Flaw
https://thehackernews.com/2021/08/pulse-secure-vpns-get-new-urgent-update.html

Ivanti 發布 Pulse Connect Secure 安全更新
https://us-cert.cisa.gov/ncas/current-activity/2021/08/06/ivanti-releases-security-update-pulse-connect-secure
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858

IBM AIX 7.1、7.2 和 VIOS 3.1 版本存在權限驗證弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-29741

近兩年駭客最常利用之29個漏洞資訊與修補方式
https://net.nthu.edu.tw/2009/mailing:announcement:20210811_02

滲透測試工具Cobalt Strike存在DoS漏洞，可以用來遏阻攻擊行動
https://www.ithome.com.tw/news/146069

VMware 發布修補多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/08/05/vmware-releases-security-updates-multiple-products
https://www.vmware.com/security/advisories/VMSA-2021-0016.html

安全廠商釋出PetitPotam漏洞非官方修補程式
https://www.ithome.com.tw/news/146090

資安事件新聞週報 2021/8/2 ~ 2021/8/6

 資安事件新聞週報 2021/8/2  ~  2021/8/6

1.重大弱點漏洞/後門/Exploit/Zero Day
Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Archive Extraction – CVE-2021-22937 (Patch Bypass)
https://research.nccgroup.com/2021/08/05/technical-advisory-pulse-connect-secure-rce-via-uncontrolled-archive-extraction-cve-2021-22937-patch-bypass/

CHT Security Red Team Discovered Several Vulnerabilities in Well-Known Domestic CTS Web Transaction System
https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344

CHT Security Red Team Discovered Several Vulnerabilities in Well-Known Domestic CTS Web Transaction System
https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344

CHT Security Red Team Discovered Several Vulnerabilities in Well-Known Domestic CTS Web Transaction System
https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344

推動國內產品漏洞修補，TWCERT/CC已指派近200個CVE漏洞，近期發布品質並獲評雙最高等級
https://www.ithome.com.tw/news/146035

美、英、澳聯手公布2020年最常被利用的CVE漏洞
https://www.ithome.com.tw/news/146015

資安事件新聞週報 2021/7/26 ~ 2021/7/30

 資安事件新聞週報 2021/7/26  ~  2021/7/30

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 發布Intersight Virtual Appliance 軟體安全更新
https://us-cert.cisa.gov/ncas/current-activity/2021/07/22/cisco-releases-security-updates

國內網路産品製造大廠修復路由器密碼硬編寫暨多個RCE嚴重漏洞
https://www.twcert.org.tw/tw/cp-104-4945-a841f-1.html

Oracle 近日發布更新以解決多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/07/20/oracle-releases-july-2021-critical-patch-update

FortiClient for Mac 6.4.3 及以下版本 CVE-2021-26089
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-26089

FortiMail 6.4.0 到 6.4.4 和 6.2.0 到 6.2.7
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-24020
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-24007

Citrix Application Delivery Controller、Citrix Gateway 和 Citrix SD-WAN WANOP Edition 的安全更新
https://us-cert.cisa.gov/ncas/current-activity/2021/07/20/citrix-releases-security-updates

D-LINK DIR-3040 1.13B03
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-21820

Kaseya VSA
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-30118

微軟七月 Patch Tuesday 資安修補包，修復 117 個漏洞，包括 9 個 0-day 漏洞
https://blog.twnic.tw/2021/07/30/19459/

Windows 11 推出第一個 Beta 版，持續改善穩定性並修除 Bug
https://www.kocpc.com.tw/archives/395979

資安事件新聞週報 2021/7/19 ~ 2021/7/23

 資安事件新聞週報 2021/7/19  ~  2021/7/23

1.重大弱點漏洞/後門/Exploit/Zero Day
Juniper 近日發布更新以解決多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/07/15/juniper-networks-releases-security-updates-multiple-products

Fortinet 近日發布更新以解決 FortiManager 和 FortiAnalyzer 的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/07/19/fortinet-releases-security-updates-fortimanager-and-fortianalyzer

Cisco 發布Adaptive Security Appliance和Firepower Threat Defense 軟體安全更新
https://us-cert.cisa.gov/ncas/current-activity/2021/07/16/cisco-releases-security-updates

Cisco fixes high-risk DoS flaw in ASA, FTD Software
https://securityaffairs.co/wordpress/120231/security/cisco-dos-flaw-asa-ftd.html

Oracle Warns of Critical Remotely Exploitable Weblogic Server Flaws
https://thehackernews.com/2021/07/oracle-warns-of-critical-remotely.html

存在16年的驅動程式漏洞可讓駭客執行惡意程式，影響HP、全錄等380款印表機
https://www.ithome.com.tw/news/145776

16-Year-Old Security Bug Affects Millions of HP, Samsung, Xerox Printers
https://thehackernews.com/2021/07/16-year-old-security-bug-affects.html

Update Your Chrome Browser to Patch New Zero‑Day Bug Exploited in the Wild
https://thehackernews.com/2021/07/update-your-chrome-browser-to-patch-new.html

Ongoing Campaign Leveraging Exchange Vulnerability Potentially Linked to Iran
https://www.secureworks.com/blog/ongoing-campaign-leveraging-exchange-vulnerability-potentially-linked-to-iran

資安事件新聞週報 2021/7/12 ~ 2021/7/16

 資安事件新聞週報 2021/7/12  ~  2021/7/16

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布更新以解決多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/07/08/cisco-releases-security-updates-multiple-products
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bpa-priv-esc-dgubwbH4

Chrome and Internet Explorer 0days used to target users in Armenia
https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/

Google：俄羅斯駭客利用Safari零時差漏洞鎖定LinkedIn用戶
https://www.ithome.com.tw/news/145662

Likely Russian government-backed actor using CVE-​2021-1879 to collect authentication cookies from Safari
https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/

Serv-U Remote Memory Escape Vulnerability being exploited in the wild CVE-2021-35211
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211#FAQ

A New Critical SolarWinds Zero-Day Vulnerability Under Active Attack
https://thehackernews.com/2021/07/a-new-critical-solarwinds-zero-day.html

Chinese Hackers Exploited Latest SolarWinds 0-Day in Targeted Attacks
https://thehackernews.com/2021/07/chinese-hackers-exploit-latest.html

Zyxel USG/Zywall 系列固件版本 4.35 至 4.64 和 USG Flex、ATP 和 VPN 系列固件版本 4.35 至 5.01
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-35029

資安事件新聞週報 2021/7/5 ~ 2021/7/9

 資安事件新聞週報 2021/7/5  ~  2021/7/9

1.重大弱點漏洞/後門/Exploit/Zero Day
QNAP 修復 HBS 3 備份應用程式的嚴重漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9328

WD證實駭客濫用My Book Live系列NAS漏洞
https://pttdigit.com/pc_shopping/M.1625402719.A.DEC.html

WD NAS 爆 0-day 漏洞，部分舊產品無法補洞只能買新的
https://www.kocpc.com.tw/archives/391850

微軟警告儘速升級PowerShell 7，以避免遠端程式碼攻擊
https://www.ithome.com.tw/news/145471

Microsoft 已發布安全更新，以解決 PrintNightmare 弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/07/06/microsoft-releases-out-band-security-updates-printnightmare
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527

資安事件新聞週報 2021/6/28 ~ 2021/7/2

 資安事件新聞週報 2021/6/28  ~  2021/7/2

1.重大弱點漏洞/後門/Exploit/Zero Day
Hackers target Cisco ASA devices after a PoC exploit code was published online
https://securityaffairs.co/wordpress/119442/hacking/cisco-asa-under-attack.html

Cisco ASA Flaw Under Active Attack After PoC Exploit Posted Online
https://thehackernews.com/2021/06/cisco-asa-flaw-under-active-attack.html

Citrix發布針對Hypervisor的安全更新
https://us-cert.cisa.gov/ncas/current-activity/2021/06/25/citrix-releases-security-updates-hypervisor

Unpatched Virtual Machine Takeover Bug Affects Google Compute Engine
https://thehackernews.com/2021/06/unpatched-virtual-machine-takeover-bug.html

WD 網絡硬碟有嚴重安全漏洞　官方建議立即中斷網絡連線
https://unwire.hk/2021/06/26/wd-my-book-nas-devices-are-being-remotely-wiped/parts/

Netgear路由器漏洞可引發資訊洩露、系統劫持
https://www.ithome.com.tw/news/145414

Watch Out! Zyxel Firewalls and VPNs Under Active Cyberattack
https://thehackernews.com/2021/06/watch-out-zyxel-firewalls-and-vpns.html

VMware Releases Security Updates
https://us-cert.cisa.gov/ncas/current-activity/2021/06/23/vmware-releases-security-updates

資安事件新聞週報 2021/6/21 ~ 2021/6/25

 資安事件新聞週報 2021/6/21  ~  2021/6/25

1.重大弱點漏洞/後門/Exploit/Zero Day
VMware Releases Security Updates
https://us-cert.cisa.gov/ncas/current-activity/2021/06/23/vmware-releases-security-updates

VMware vCenter Server RCE 6.5 / 6.7 / 7.0 - Remote Code Execution (RCE) (Unauthenticated)
https://www.exploit-db.com/exploits/50056

Solaris SunSSH 11.0 x86 - libpam Remote Root (3)
https://www.exploit-db.com/exploits/50039

Cisco Releases Security Updates for Multiple Products
https://us-cert.cisa.gov/ncas/current-activity/2021/06/17/cisco-releases-security-updates-multiple-products

群暉 Synology 宣布 DSM 7.0 將於 6/29 推出正式版以及 C2 公有雲四項新服務
https://news.xfastest.com/interview/96968/%E7%BE%A4%E6%9A%89-synology-%E5%AE%A3%E5%B8%83-dsm-7-0-%E5%B0%87%E6%96%BC-6-29-%E6%8E%A8%E5%87%BA%E6%AD%A3%E5%BC%8F%E7%89%88%E4%BB%A5%E5%8F%8A-c2-%E5%85%AC%E6%9C%89%E9%9B%B2%E5%9B%9B%E9%A0%85%E6%96%B0/

Dell裝置的管理軟體SupportAssist再爆4漏洞，將允許駭客自遠端執行程式
https://www.ithome.com.tw/news/145255

WD呼籲「My Book Live」用戶快把網路線拔掉，否則硬碟內容可能會被駭客清空
https://www.techbang.com/posts/87940-wd-calls-for-my-book-live

合勤警告SSL VPN、防火牆裝置遭駭客鎖定
https://www.ithome.com.tw/news/145256

一週釋出兩次更新！Google 緊急修補 4 項 Chrome 高風險漏洞
https://3c.ltn.com.tw/news/44868

資安事件新聞週報 2021/6/14 ~ 2021/6/18

 資安事件新聞週報 2021/6/14  ~  2021/6/18

1.重大弱點漏洞/後門/Exploit/Zero Day
Zoll心臟電擊器管理軟體重大漏洞可上傳Excel檔執行惡意指令
https://www.ithome.com.tw/news/145056

CISA Releases Advisory on ZOLL Defibrillator Dashboard
https://us-cert.cisa.gov/ncas/current-activity/2021/06/14/cisa-releases-advisory-zoll-defibrillator-dashboard

Google App爆資安漏洞！用戶隱私數據面臨風險
https://newtalk.tw/news/view/2021-06-18/590929

Cisco Releases Security Updates for Multiple Products
https://us-cert.cisa.gov/ncas/current-activity/2021/06/17/cisco-releases-security-updates-multiple-products

7-Year-Old Polkit Flaw Lets Unprivileged Linux Users Gain Root Access
https://thehackernews.com/2021/06/7-year-old-polkit-flaw-lets.html

資安事件新聞週報 2021/6/7 ~ 2021/6/11

 資安事件新聞週報 2021/6/7  ~  2021/6/11

1.重大弱點漏洞/後門/Exploit/Zero Day
GitHub Updates Policy to Remove Exploit Code When Used in Active Attacks
https://thehackernews.com/2021/06/github-updates-policy-to-remove-exploit.html

F5 Networks BIG-IP : BIG-IP APM ACL bypass vulnerability (K75540265)
https://www.tenable.com/plugins/nessus/150460

New UAF Vulnerability Affecting Microsoft Office to be Patched Today
https://thehackernews.com/2021/06/new-uaf-vulnerability-affecting.html

10 Critical Flaws Found in CODESYS Industrial Automation Software
https://thehackernews.com/2021/06/10-critical-flaws-found-in-codesys.html

Check Point在Microsoft Office中發現四個安全漏洞
https://finance.sina.com.cn/tech/2021-06-09/doc-ikqcfnca0056198.shtml

微軟 6 月的星期二補丁：修補了 50 個漏洞，六個零日漏洞被廣泛利用
https://docsxyz.com/zh-hant/wiki/news/microsoft-june-2021-patch-tuesday-20210609

Update Your Windows Computers to Patch 6 New In-the-Wild Zero-Day Bugs
https://thehackernews.com/2021/06/update-your-windows-computers-to-patch.html

資安事件新聞週報 2021/5/31 ~ 2021/6/4

 資安事件新聞週報 2021/5/31  ~  2021/6/4

1.重大弱點漏洞/後門/Exploit/Zero Day
Fortinet fixed a Post-Auth RCE in FortiWeb (CVE-2021-22123)
https://www.fortiguard.com/psirt/FG-IR-20-120

Researchers Warn of Critical Bugs Affecting Realtek Wi-Fi Module
https://thehackernews.com/2021/06/researchers-warn-of-critical-bugs.html

Open Source Vulnerabilities Converging DevOps & SecOps
https://cybersecdn.com/index.php/2021/05/31/open-source-vulnerabilities-converging-devops-secops/

FBI警告APT組織廣泛開採各類已知漏洞，廠商給修補但使用者無作為，等於坐等被入侵
https://www.ithome.com.tw/news/144692

SonicWall產品存在安全性弱點
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0014

Newly Discovered Bugs in VSCode Extensions Could Lead to Supply Chain Attacks
https://thehackernews.com/2021/05/newly-discovered-bugs-in-vscode.html

CSS-WHAT PACKAGE 直到5.0.0 於NODE.JS ATTRIBUTE 未知漏洞
https://vuldb.com/zh/?id.176096

RHEL 7 : kernel-alt (RHSA-2021:1379)
https://www.tenable.com/plugins/nessus/149235

Hackers‌ ‌Actively‌ ‌Exploiting‌ ‌0-Day‌ ‌in WordPress Plugin Installed on Over ‌17,000‌ ‌Sites
https://thehackernews.com/2021/06/hackers-actively-exploiting-0-day-in.html

資安事件新聞週報 2021/5/24 ~ 2021/5/28

 資安事件新聞週報 2021/5/24  ~  2021/5/28

1.重大弱點漏洞/後門/Exploit/Zero Day
New High-Severity Vulnerability Reported in Pulse Connect Secure VPN
https://thehackernews.com/2021/05/new-high-severity-vulnerability.html

Updates to Alert on Pulse Connect Secure
https://us-cert.cisa.gov/ncas/current-activity/2021/05/27/updates-alert-pulse-connect-secure

Synology 14 項套件的生命週期終止公告
https://www.synology.com/zh-tw/products/status/EOL_announcement_for_synology_package_202105

CVE-2021-21985: VMware vCenter Server遠程代碼執行漏洞通告
https://cert.360.cn/warning/detail?id=21bda4287b2b47416e93cc7817bf4a1a

VMware虛擬化解決方案發現遠程代碼執行漏洞
https://finance.sina.com.cn/tech/2021-05-26/doc-ikmyaawc7657251.shtml

Critical RCE Vulnerability Found in VMware vCenter Server — Patch Now!
https://thehackernews.com/2021/05/critical-rce-vulnerability-found-in.html

研究人員揭露PDF規格的兩個安全漏洞，將允許駭客偷偷竄改已認證文件內容
https://www.ithome.com.tw/news/144669

macOS 連爆多個 0-Day 漏洞 !! 黑客可取得 Mac 設備的麥克風、鏡頭、屏幕錄影等權限
https://hk.xfastest.com/116752/apple-macos-0-day-loopholes/

macOS 曝重大零日漏洞！蘋果釋出修復版本，用戶盡快更新以免遭駭
https://3c.ltn.com.tw/news/44487

Ｍac重大漏洞更新　防駭客偷錄螢幕隱私
https://tw.appledaily.com/gadget/20210526/X3BFYPLDFJHYXOHO7P7N47EGUI/

Apple‌ Issues Patches to Combat Ongoing 0-Day Attacks on macOS, tvOS
https://thehackernews.com/2021/05/apple-issues-patches-to-combat-ongoing.html

Apple Security Update for Safari - Exploitation in the Wild Reported
https://support.apple.com/en-us/HT212340

設計違反ARM架構規範！蘋果M1曝出無法修復漏洞
https://www.eet-china.com/mp/a53737.html

Unfixable Apple M1 chip bug enables cross-process chatter, breaking OS security model
https://www.theregister.com/2021/05/27/apple_m1_chip_bug/

廣告商可能竊取資訊　外媒：蘋果M1具有安全漏洞
https://finance.ettoday.net/amp/amp_news.php7?news_id=1992330

資安事件新聞週報 2021/5/17 ~ 2021/5/21

 資安事件新聞週報 2021/5/17  ~  2021/5/21

1.重大弱點漏洞/後門/Exploit/Zero Day
Google I / O之前的新漏洞聲稱Android 12可能包括小部件和通知的更改
https://www.inin.news/?p=15627

Android Issues Patches for 4 New Zero-Day Bugs Exploited in the Wild
https://thehackernews.com/2021/05/android-issues-patches-for-4-new-zero.html

Android的5月安全更新已有4個漏洞遭到開採
https://www.ithome.com.tw/news/144536

MikroTik RouterOS 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-20214

Cisco Link Layer Discovery Protocol緩衝區溢出漏洞
https://vul.wangan.com/a/CNVD-2021-35515

Qnap Systems Malware Remover 操作系统命令注入漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36198

RHEL 7 / 8 : Ansible security update (2.9.20) (Moderate) (RHSA-2021:1343)
https://www.tenable.com/plugins/nessus/148945

ORACLE SOLARIS 10 BASH 未知漏洞
https://vuldb.com/zh/?id.92787

ORACLE WEBCENTER CONTENT 10.1.3.5.1/11.1.1.6.0/11.1.1.7.0 SITE STUDIO 未知漏洞
https://vuldb.com/zh/?id.9607

Oracle Secure Global Desktop輸入驗證錯誤漏洞
https://www.oracle.com/security-alerts/cpuapr2021.html

ORACLE HTTP SERVER 11.1.1.7.0/12.1.2.0 PLUGIN 1.1 未知漏洞
https://vuldb.com/zh/?id.67085

資安事件新聞週報 2021/5/10 ~ 2021/5/14

 資安事件新聞週報 2021/5/10  ~  2021/5/14

1.重大弱點漏洞/後門/Exploit/Zero Day
所有Wi-Fi裝置皆存在FragAttacks漏洞，可被駭客用來竊取個人資訊和攻擊裝置
https://www.ithome.com.tw/news/144352

Nearly All Wi-Fi Devices Are Vulnerable to New FragAttacks
https://thehackernews.com/2021/05/nearly-all-wifi-devices-are-vulnerable.html

研究人員再掀蘋果AirTag與Find My安全漏洞
https://www.ithome.com.tw/news/144390

模仿 AirTag 傳輸模式！資安業者：蘋果「Find My」功能恐有安全漏洞
https://www.inside.com.tw/article/23500-find-my-network-arbitrary-data-messages

Juniper 產品存在安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/05/11/juniper-networks-releases-security-updates

CVE-2021-21551- Hundreds of Millions of Dell Computers at Risk Due to Multiple BIOS Driver Privilege Escalation Flaws
https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/

Windows版Cisco AnyConnect Secure Mobility Client
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-1496
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-1430
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-1429
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-1428
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-1427

Cisco Security Advisory - May 11 2021
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu

Cisco 近日發布更新以解決多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/05/06/cisco-releases-security-updates-multiple-products

資安事件新聞週報 2021/5/3 ~ 2021/5/7

 資安事件新聞週報 2021/5/3  ~  2021/5/7

1.重大弱點漏洞/後門/Exploit/Zero Day
Pulse Connect Secure 9.0R3 / 9.1R1
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-22893

Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol
https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop/
https://github.com/antonioCoco/RemotePotato0

PULSE SECURE設備存在安全漏洞(CVE-2021-22893~22894與CVE-2021-22899~22900)，允許攻擊者遠端執行任意程式碼，請儘速確認並進行更新
https://www.isda.org.tw/2021/05/05/9b3d7c9821f97596a142e527c0b6a914/

多個駭客組織鎖定美國國防產業與全球政府機關之Pulse Connect Secure VPN裝置漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9213

Hackers Exploit SonicWall Zero-Day Bug in FiveHands Ransomware Attacks
https://thehackernews.com/2021/04/hackers-exploit-sonicwall-zero-day-bug.html

VMware vRealize Business for Cloud 遠程代碼執行漏洞（CVE-2021-21984）
https://s.tencent.com/research/bsafe/1306.html

Critical Patch Out for Critical Pulse Secure VPN 0-Day Under Attack
https://thehackernews.com/2021/05/critical-patch-out-for-month-old-pulse.html

BIOS PrivEsc Bugs Affect Hundreds of Millions of Dell PCs Worldwide
https://thehackernews.com/2021/05/bios-privesc-bug-affects-hundreds-of.html

Apple 修復 macOS 一個可跳過系統安全檢查，且已遭大規模濫用的 0-day 漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9199

watchOS 7.4.1 更新推出：修正 WebKit 漏洞，建議所有使用者安裝
https://aplus425.com/posts/3336

Cisco 近日發布更新以解決多個產品的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/04/29/cisco-releases-security-updates-multiple-products

Critical Flaws Hit Cisco SD-WAN vManage and HyperFlex Software
https://thehackernews.com/2021/05/critical-flaws-hit-cisco-sd-wan-vmanage.html

CVE-2021-1520 : Cisco RV34X Series – Privilege Escalation in vpnTimer
https://www.iot-inspector.com/blog/advisory-cisco-rv34x-series-privilege-escalation-vpntimer/

New Qualcomm Chip Bug Could Let Hackers Spy On Android Devices
https://thehackernews.com/2021/05/new-qualcomm-chip-bug-could-let-hackers.html

New Spectre Flaws in Intel and AMD CPUs Affect Billions of Computers
https://thehackernews.com/2021/05/new-spectre-flaws-in-intel-and-amd-cpus.html

VMware Security Advisory VMSA-2021-0007
https://www.vmware.com/security/advisories/VMSA-2021-0007.html

Cisco Security Advisories May 5 2021
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&firstPublishedStartDate=2021%2F05%2F05&firstPublishedEndDate=2021%2F05%2F05&limit=50

ALERT — New 21Nails Exim Bugs Expose Millions of Email Servers to Hacking
https://thehackernews.com/2021/05/alert-new-21nails-exim-bugs-expose.html

Multiple Vulnerabilities in Exim Disclosed
https://www.exim.org/static/doc/security/CVE-2020-qualys/
https://www.qualys.com/2021/05/04/21nails/21nails.txt

Xen Security Advisory XSA-370
https://xenbits.xen.org/xsa/advisory-370.html

IBM QRadar SIEM Security Bulletins - May 2021
https://www.ibm.com/support/pages/node/6449662
https://www.ibm.com/support/pages/node/6449664
https://www.ibm.com/support/pages/node/6449668
https://www.ibm.com/support/pages/node/6449672
https://www.ibm.com/support/pages/node/6449674
https://www.ibm.com/support/pages/node/6449678
https://www.ibm.com/support/pages/node/6449682
https://www.ibm.com/support/pages/node/6449690

IBM Spectrum Protect Client 版本 8.1.0.0到 8.1.11.0
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-20532
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-29672

2漏洞恐遭駭客利用！蘋果 iOS 14.5.1 更新釋出
https://www.jyes.com.tw/news.php?act=view&id=1621

隱藏於 Dell 電腦 12 年的安全漏洞被發現　影響超過 1 億台 PC
https://www.newmobilelife.com/2021/05/05/dell-firmware-bug-fix-dsa-2021-088/

Apple Security Updates May 3 2021 - Exploitation in the Wild Reported
https://support.apple.com/kb/HT201222
https://support.apple.com/en-us/HT212335
https://support.apple.com/en-us/HT212336
https://support.apple.com/en-us/HT212339
https://support.apple.com/en-us/HT212341

Apple Releases Urgent Security Patches For Zero‑Day Bugs Under Active Attacks
https://thehackernews.com/2021/05/apple-releases-urgent-security-patches.html

已經有駭客入侵！Apple推出iOS 14.5.1更新版本，修正Safari的安全性漏洞問題
https://reurl.cc/xgRYAb

蘋果修補4個已遭開採的WebKit漏洞
https://www.ithome.com.tw/news/144180

Samba 存在安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/04/30/samba-releases-security-updates

A New PHP Composer Bug Could Enable Widespread Supply-Chain Attacks
https://thehackernews.com/2021/04/a-new-php-composer-bug-could-enable.html

微軟將從七月起徹底移除 Windows 10 系統自帶的 Adobe Flash Player
https://reurl.cc/8ykry4

微軟相關系統的重要資訊安全訊息公告
https://it.nycu.edu.tw/news/6613/

2.銀行/金融/保險/證券/支付系統/ 新聞及資安
手機報稅「三免」超方便　掌握「三要」防駭客
https://www.cardu.com.tw/news/detail.php?43248

中華電：4月台灣DDoS攻擊月增近4倍 金融保險業居冠
https://www.cna.com.tw/news/afe/202105070081.aspx

配偶合併報稅可否用手機？財政部解答網友4大疑問
https://www.cna.com.tw/news/firstnews/202105075013.aspx

台灣2021銀行論壇》國泰金控總經理李長庚：跨機構資安 應分級認證
https://ec.ltn.com.tw/article/paper/1447128

超好玩 華銀首創結合遊戲銀行APP
https://times.hinet.net/news/23318541

金融資安行動方案發布9個月，金管會一次揭露最新執行成果與更多規畫細節
https://www.ithome.com.tw/news/144233

手機報稅免插卡、速度快！這「六種情況」不適用
https://reurl.cc/4yxkqV

手機報稅要防駭 KPMG提醒三免三要
https://money.udn.com/money/story/11994/5429472

駭客蠢蠢欲動，首次手機報稅小心主動獵殺、請君入甕攻擊
https://technews.tw/2021/05/03/kpmg-tax/

加拿大卑詩學生貸款網站遭攻擊
https://www.epochtimes.com/b5/21/5/4/n12922976.htm

純網銀如何防範網路金融犯罪？樂天銀行總經理佐伯和彥揭露2大原則
https://www.ithome.com.tw/news/144184

IFRS 17發出限時令！產險數位轉型一次到位即刻啟動
https://udn.com/news/story/7238/5416070

Experian exposes credit scores through unprotected API
https://siliconangle.com/2021/05/02/experian-exposes-credit-scores-unprotected-api/

3.電子支付/行動支付/pay/資安
美國紐約街泊支付軟體ParkMobile被駭2100萬用戶個資外洩
https://www.worldjournal.com/wj/story/121381/5432085

超過一半台灣人在用，電支市場有這兩大觀察！街口、Line Pay各自贏在哪
https://www.bnext.com.tw/article/62735/digital-payment-2021-march

LINE Pay擴大燒錢、街口踩住煞車，台灣行動支付大戰下一步怎麼走
https://www.bnext.com.tw/article/62673/line-pay-jkos

用電子支付買罐飲料，財政部竟要索取所有個資隱私，合理嗎
https://www.inside.com.tw/article/23428-e-pay-data

市場規劃防疫動線 電子支付減少接觸
https://reurl.cc/9ZldNO

靠60人IT團隊衝刺業務擴張，電子支付龍頭揭平臺化秘訣
https://www.ithome.com.tw/people/143882

日本大臣指鈔票恐致接觸感染 籲用電子支付防疫
https://www.cna.com.tw/news/aopl/202105040224.aspx

星、泰電子支付平台連結 用手機號碼可跨境轉帳
https://www.cna.com.tw/news/aopl/202104290200.aspx

閃退、掃不到…他批行動支付「排隊元凶」 網：是人的問題
https://udn.com/news/story/7239/5420578

胡亦嘉爆粗話槓金管會 嗆街口支付絕不改名
https://reurl.cc/ZQmR3l

4.加密貨幣/挖礦/區塊鍊/智能合約 資安
兩岸微流行／區塊鏈養豬 機器人巡檢
https://udn.com/news/story/7332/5429120

BSC首現閃電貸攻擊／技術解析 Spartan Protocol 遭駭手法，造成 3 千萬美元損失
https://www.blocktempo.com/the-first-flash-loan-attack-occured-on-binance-smart-chain/

虛擬貨幣成贖金新寵　歐洲央行籲必須全球監管
https://www.ctwant.com/article/115533

以太幣價格創新高引發挖礦熱潮 外媒示警：顯卡短缺恐加劇
https://www.chinatimes.com/realtimenews/20210504006208-260410?chdtv

行政院內互踢皮球2年半　7大部會無人想管虛幣交易
https://www.ctwant.com/article/115534

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
勒索軟體猖獗，美國發起打擊勒索軟體任務小組
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9214

卡巴斯基發現疑似CIA工具
https://www.ithome.com.tw/news/144154

SonicWall SSL VPN設備漏洞被用於勒索軟體攻擊
https://www.ithome.com.tw/news/144166

New Chinese Malware Targeted Russia's Largest Nuclear Submarine Designer
https://thehackernews.com/2021/05/new-chinese-malware-targeted-russias.html

DC Metro Police Hit With Ransomware Attack
https://www.infosecurity-magazine.com/news/ransomware-group-dc-cops-informant/
https://www.infosecurity-magazine.com/news/global-government-outsourcer-serco/
https://www.infosecurity-magazine.com/news/cyberattack-on-nba-team/

Ousaban (Javali) Brazilian Banking Trojan Now Steals Credentials from Popular Regional Email Services
https://www.welivesecurity.com/2021/05/05/ousaban-private-photo-collection-hidden-cabinet/
https://seguranca-informatica.pt/latin-american-javali-trojan-weaponizing-avira-antivirus-legitimate-injector-to-implant-malware/#.YJQlvGZKjUI

UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat
https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html

Sysrv-Hello Cryptominer Botnet Expands its Infrastructure
https://www.lacework.com/sysrv-hello-expands-infrastructure/

New Pingback Malware Using ICMP Tunneling to Evade C&C Detection
https://thehackernews.com/2021/05/new-pingback-malware-using-icmp.html

A Rust-based Buer Malware Variant Has Been Spotted in the Wild
https://thehackernews.com/2021/05/a-new-buer-malware-variant-has-been.html

Sophos : 亞太區平均勒索軟體復原成本一年暴增兩倍，且付錢無法了事
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9197

求救 !!! QNAP-TS253B 受到駭客攻擊,NAS 被安裝了勒索軟件
https://forum.hkgolden.com/thread/7406124/page/1

New Stealthy Rootkit Infiltrated Networks of High-Profile Organizations
https://thehackernews.com/2021/05/new-stealthy-rootkit-infiltrated.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
高通 5G 晶片遭爆有安全漏洞！近 3 成手機 Android 恐有竊聽風險
https://3c.ltn.com.tw/news/44249

高通數據機晶片被曝嚴重安全漏洞，駭客可讀取大多Android用戶的簡訊以及語音通話
https://www.techbang.com/posts/86544-qualcomm-baseband-exposes-serious-security-vulnerabilities

禍從口出？聲音社交Clubhouse 爆紅背後的法律問題
https://udn.com/news/story/6877/5440281

駭客盛典「天府杯」陰謀：中國入侵 iPhone 祕密監控維吾爾族
https://technews.tw/2021/05/07/how-china-turned-a-prize-winning-iphone-hack-against-the-uyghurs/

陸官方證實33款知名App存在資安疑慮 百度、騰訊全上榜了
https://udn.com/news/story/11017/5439059

你中招沒？百度騰訊等33款App違法收集個資
https://www.secretchina.com/news/b5/2021/05/07/971006.html

「滴滴出行」來台被控引入中資 女負責人一審判無罪
https://news.ltn.com.tw/news/society/breakingnews/3523203

中毒？iPhone妹好奇「點IG精選動態」 下秒手機當掉崩潰
https://news.ebc.net.tw/news/living/259330

還敢用手機看謎片？當心裝置恐遭駭　個資外流還可能電話費暴漲
https://cnews.com.tw/134210503a03/

6 Unpatched Flaws Disclosed in Remote Mouse App for Android and iOS
https://thehackernews.com/2021/05/6-unpatched-flaws-disclosed-in-remote.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件
尋找資安女婕思 嘉義女中奪全國亞軍
https://news.ltn.com.tw/news/life/breakingnews/3522001

企業採用5G專網就安全了嗎？ 專家告訴你哪裡不夠安全
https://times.hinet.net/news/23320019

資安「完美風暴」只會更多！台灣護國群山有4成待改進
https://finance.ettoday.net/news/1974064

豪撒2800萬想賺45億　國際駭客組織強攻護國神山群
https://www.ctwant.com/article/115531

駭客企業化時代來臨！政府、業界該如何協作，打造台灣「資安護國神山」
https://buzzorange.com/techorange/2021/05/04/taiwan-data-security-industry-development/

多功能型SRE化身內部信心來源，天天成為開發團隊後盾
https://www.ithome.com.tw/news/144122

靠AIoT和5G邁向智慧校園，逢甲還要用雲端彈性化IT架構
https://www.ithome.com.tw/people/144118

F5: 超過2/3的API安全事件歸因於API端點不完整的身分認證和授權
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9202

虛擬修補為資安團隊爭取更多時間評估漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9198

你找漏洞他勒贖　駭客分組夾殺展開「世上最瘋狂攻擊組織」
https://today.line.me/tw/v2/article/Je5L1q

幫派販毒 開「西藥房」、「機房」撈金
https://udn.com/news/story/122146/5427440?from=udn-catebreaknews_ch2

是德科技推安全報告 點名網路安全三大致命問題
https://turnnewsapp.com/livenews/tech/A05622002021050713255713

因應重大網攻發生頻率增加，專家建議資安曝險評估每一周至少要做一次
https://www.ithome.com.tw/news/144192

香港醫管局稱過去5年內部電郵系統受網絡電郵攻擊增逾一倍
https://reurl.cc/v5My5e

美國上市櫃公司投保資安險比例 達8成以上
https://www.chinatimes.com/realtimenews/20210506001960-260410?chdtv

美國亞歷桑納州選票稽查 被爆選票、筆電無人看管
https://www.worldjournal.com/wj/story/121172/5440667

美國防部：止戰重於參戰 與中衝突不可取
https://www.chinatimes.com/newspapers/20210502000053-260303?chdtv

瑞典國防企業SAAB成為駭客及商業間諜的目標
https://reurl.cc/xgRYgz

比利時多個公部門遭到大規模 DDoS 攻陷
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9212

記者墳場! 葉門內戰6年 逾300名記者喪生 新聞自由度倒數
https://newtalk.tw/news/view/2021-05-07/570625

疑似中國駭客網釣滲透俄羅斯潛艇設計系統
https://www.ithome.com.tw/news/144165

中共盜竊技術自取其禍
https://hk.epochtimes.com/news/2021-05-02/87055747

NSA, FBI, DHS expose Russian intelligence hacking tradecraft
https://www.cyberscoop.com/nsa-fbi-dhs-russian-hacking-svr-solarwinds-apt29-cozy-bear/

New Study Warns of Security Threats Linked to Recycled Phone Numbers
https://thehackernews.com/2021/05/new-study-warns-of-security-threats.html

Cost of Account Unlocks, and Password Resets Add Up
https://thehackernews.com/2021/04/cost-of-account-unlocks-and-password.html

『竹南廠』資安工程師
http://www.104.com.tw/jb/104i/job/view?j=6wntn

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞
Whoscall Watchmen系統 一小時內預警金融電訊詐騙
https://times.hinet.net/news/23314031

網路詐騙橫行，趨勢科技示警母親節三大騙局
https://ccc.technews.tw/2021/05/05/trend-micro-mothers-day-defraud/

個資大外洩 民眾缺乏求償意識 資安險通報理賠不到10件
https://www.chinatimes.com/realtimenews/20210506001753-260410?chdtv

10 個最容易被冒用的品牌揭曉！小心一封 email 就把你的個資全洩漏
https://www.managertoday.com.tw/articles/view/62904

尚不為外界所知的全新駭侵組織發動新一波全球性釣魚攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9207

如何查詢您的資料是否已在網路上外洩
https://blog.twnic.tw/2021/05/06/18063/

隱私意識抬頭！Google 跟進蘋果要求開發者揭露應用程式個資取用範圍
https://www.inside.com.tw/article/23429-new-safety-section-in-google-play

你的密碼一招打天下？為加強資安防護，Google 將強制採用雙重認證登入
https://www.inside.com.tw/article/23433-google-will-soon-make-two-factor-authentication-mandatory

Google 帳號未來將自動啟動兩階段認證（如果符合條件的話）
https://www.kocpc.com.tw/archives/382463

5月報稅季駭客活躍期 資安專家：留意2大詐騙手法
https://www.chinatimes.com/realtimenews/20210501001365-260410?chdtv

來台隔離慘遭駭客詐騙！黃秋生喊靠北怒斥「王X蛋」
https://stars.udn.com/star/story/10091/5429839

誆誤買破萬餐券！？ 她使「十萬個為什麼」逼退詐騙集團
https://reurl.cc/Dv0N7m

Over 40 Apps With More Than 100 Million Installs Found Leaking AWS Keys
https://thehackernews.com/2021/05/over-40-apps-with-more-than-100-million.html

Passwordstate Warns of Ongoing Phishing Attacks Following Data Breach
https://thehackernews.com/2021/04/passwordstate-warns-of-ongoing-phishing.html

E.研究報告
Google Apps Script 操作試算表資料庫防駭技巧﹍防止程式碼注入攻擊
https://www.wfublog.com/2021/05/google-apps-script-sheet-js-injection-protection.html

Operation Muzabi: Phishing Target Reconnaissance and Attack Resource Analysis
https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf

UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat
https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html

The UNC2529 Triple Double: A Trifecta Phishing Campaign
https://www.fireeye.com/blog/threat-research/2021/05/unc2529-triple-double-trifecta-phishing-campaign.html

F.商業
採用零信任安全的 Aruba ESP整合式基礎架構平台建構生態圈，超過150多種資安解決方案加入
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9194

Check Point Harmony Endpoint 100%成功偵測MITRE ATT&CK攻擊手法
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9209

趨勢科技發表次世代ICS端點防護解決方案
https://www.techbang.com/posts/86451-trend-micro-releases-next-generation-ics-endpoint-protection

中華電攜手子公司中華資安國際，響應政府資安即國安2.0戰略
https://reurl.cc/jqAX8m

中菲行強化資安系統 獲英國BSI認證
https://www.chinatimes.com/realtimenews/20210505001807-260410?chdtv

精誠首季獲利創同期新高 展望未來營運樂觀
https://money.udn.com/money/story/5710/5436114

臺灣資安大會　精誠展示五大資安方案
https://ctee.com.tw/industrynews/technology/456146.html

涉資安風險 騰訊與美磋商盼維持遊戲開發商持股
https://udn.com/news/story/7331/5437544

女星投身網路資安業　新加坡妙賺「疫外之財」
https://www.mirrormedia.mg/story/20210506ent008/

思科Duo無密碼身份驗證提供更強的安全保護
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9211

強調安全節能自動化　通過NVIDIA認證 新款PowerEdge　強打AI數據分析
https://www.netadmin.com.tw/netadmin/zh-tw/market/350F6C90C3DA4DBFA7A8658C4B520C47

遠傳攜數聯資安展出四大防護應用
https://money.udn.com/money/story/5612/5430198?from=edn_catenewest_story

ZUSO 如梭世代組第一個專為企業安全量身打造的紅隊
https://money.udn.com/money/story/10860/5430671

奧義智慧揪5家技術夥伴 推普惠資安願景
https://ec.ltn.com.tw/article/breakingnews/3521130

CYBERSEC 2021 奧義智慧以VR 虛擬實境大秀資安戰情室
https://ctee.com.tw/industrynews/technology/455050.html

Gogolook 與奧義智慧聯手，Whoscall Watchmen 企業偽冒預警系統登場
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9190

G.政府
企業遭駭客攻擊不再沒轍　政院將訂出快速通報機制
https://tw.appledaily.com/politics/20210505/A3A36MURMFGVLDRNQXVPP2VIFM/

政院上修台灣資安產值 2025年可達800億
https://news.ltn.com.tw/news/politics/breakingnews/3522080

國發會：未來四年政府、民間投入83億元發展資安產業
https://www.chinatimes.com/realtimenews/20210505006222-260410?chdtv

總統宣示成立資安署 網羅200資安高手
https://reurl.cc/2bnxbE

台中市警局成立「無人機隊」12台無人機　維安新利器
https://www.ftvnews.com.tw/news/detail/2021507C03M1

IT大臣唐鳳從立法院「跨足」到錄音室！為閃靈首開金口挑戰「說唱」台語
https://www.ftvnews.com.tw/news/detail/2021506W0269

AIT：美臺資安合作步伐一致，蔡英文：臺灣資安已是國際品牌
https://reurl.cc/V39GRZ

總統：打造世界級資安產業鏈
https://www.sinotrade.com.tw/richclub/news/609192aa63c4118638b3523c

台總統宣布2.0戰略將成立資安署 AIT處長出席相挺
https://reurl.cc/l01E46

立院初審通過成立數位發展部
https://www.chinatimes.com/realtimenews/20210505006262-260410?chdtv

先有個資保護專責機關，才有健全的數位發展
https://www.coolloud.org.tw/node/95651

智慧城市落漆！北市府7成APP下架 2100萬元建置費打水漂
https://news.ltn.com.tw/news/politics/breakingnews/3523356

北市府7成APP遭下架 建置費達2173萬
https://news.ltn.com.tw/news/life/paper/1447245

劉櫂豪要求NCC 強化資安作為
https://news.ltn.com.tw/news/politics/paper/1447257

【開放外聘200人？】對「數位部」相關草案的幾點看法
https://tw.appledaily.com/forum/20210507/XLVWSNYRVNAMPCRJGW37ZI5JDM/

台南市長黃偉哲呼應數位發展部落地台南 前瞻數位國家發展
https://times.hinet.net/news/23320716

立院初審通過成立數位發展部 NCC擬新設網際網路事務處
https://cnews.com.tw/134210507a04/

科技部資安暨智慧科技研發大樓開幕啟用
https://money.udn.com/money/story/10860/5416809

經濟部工業局推動資安產業自主能量 臺灣資安館展現產業真實力
https://money.udn.com/money/story/11799/5431995

謝繼茂:中華電信動用500人力投入協助政府科技防疫
https://www.chinatimes.com/realtimenews/20210504000818-260410?chdtv

超扯法官！開庭狂遲到　要書記官「唬爛電腦有問題」被罰俸63萬
https://tw.appledaily.com/local/20210507/TFYBNE3JDNEHJKBD6NFK6724GQ/

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車 相關資安
ICS-CERT Advisories May 04 2021
https://us-cert.cisa.gov/ics/advisories/icsa-21-124-01
https://us-cert.cisa.gov/ics/advisories/icsa-21-124-02

數位轉型驅動台灣智慧製造面向資安新挑戰
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9201

捷而思提供IT/OT資安三要素: 機密性、完整性與可用性
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9191

專為工業環境設計，趨勢科技發表原生OT端點防護TXOne StellarProtect
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9205

駭客攻擊愈加猖獗，趨勢呼籲製造業三步驟擴大資安戰備範圍
https://technews.tw/2021/05/03/it-ot/

全面提升資安等級　研華推私有雲工業物聯網解決方案
https://www.digitimes.com.tw/iot/article.asp?cat=158&cat1=20&cat2=10&id=0000609612_6sv7edqv054pli3mgp8cz

強化ICS工控網路安全 ShareTech推出專屬防護設備
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000608887_2ax9jtqu78nm9887fnv3n

安全女力成立專為數十億 IoT 裝置提供安全防護的新創公司
https://technews.tw/2021/05/04/thistle-startup-secure-billions-of-iot-devices/

【有恆為 AI 成功之本】在 HR e 化中做到 AIoT 數位轉型的震旦雲
https://www.inside.com.tw/article/23313-aurora-ehr

Microsoft Finds 'BadAlloc' Flaws Affecting Wide-Range of IoT and OT Devices
https://thehackernews.com/2021/04/microsoft-finds-badalloc-flaws.html

I.教育訓練
How Should the Service Desk Reset Passwords
https://thehackernews.com/2021/05/how-should-service-desk-reset-passwords.html

應用程式開發安全(PDF)
https://drive.google.com/open?id=1ALZxB3leysWqdbRYa0sI4gmnc11Sx9b8

網路安全管理(PDF)
https://drive.google.com/open?id=1z10O4-Wo9HPfPXhH8kYyOMo201pP7qcI

實體安全與資安管理(PDF)
https://drive.google.com/open?id=1OYFLHKPGFm9MWI-LBcEERCgXXVf-WAAM

惡意程式防護介紹(PDF)
https://drive.google.com/open?id=1NAlRvwBjTqieakNa2eHRTyx2w80DxWpS

資安事件回應(PDF)
https://drive.google.com/open?id=1-0KzuXQMHcJPflTqjTZ41M0mXucjUwqh

弱點管理與主機強固(PDF)
https://drive.google.com/open?id=1DCQF74rRmy4P5ruoqOij-S95FqcUUy-V

社交工程&資訊安全教育訓練
https://bulletin.dyu.edu.tw/file/A0282/49880.pdf

J.人工智慧/AI/ML/人臉辨識
ICC數位經濟委員會 專家分享資安及AI成果
https://money.udn.com/money/story/5635/5441729

首度整合 AI 加速架構，英特爾第三代 Xeon 同時滿足效能與資安要求
https://buzzorange.com/techorange/2021/04/26/3rd-gen-xeon-processor/

花蓮慈濟用一支App整合兩大醫院核心系統，更導入醫療專用AI框架Clara判讀PACS影像
https://www.ithome.com.tw/news/144151

6.近期資安活動及研討會
塔羅牌與 UX 的火花 5/8
https://www.meetup.com/GDGTaipei/events/277707447/

從Python到TensorFlow線上讀書會-二部曲(11) -決策樹 5/11
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/274981288/

【Flutter Night】0512
https://www.meetup.com/Flutter-Taipei/events/277647481/

SDN x Cloud Native Meetup #38 5/13
https://www.meetup.com/CloudNative-Taiwan/events/277643179/

OWASP Taiwan Meetup (May) 5/18
https://www.meetup.com/Taipei-OWASP-Meetup-Group/events/277773931/

國家高速網路與計算中心教育訓練課程 TWCC容器運算服務實作基礎課程 5/19
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3951&from_course_list_url=homepage

Why Self-Organization Matters For Scrum Teams 5/20
https://www.meetup.com/the-liberators-network-taiwan-user-group-taipei-taiwan/events/276003653/

國家高速網路與計算中心教育訓練課程 TWCC HPC高速運算服務實作基礎課程 5/20
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3952&from_course_list_url=homepage

國家高速網路與計算中心教育訓練課程 TWCC 虛擬運算服務實作基礎課程 5/20
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3953&from_course_list_url=homepage

國家高速網路與計算中心教育訓練課程 【資安專題講座】資安管理策略與威脅趨勢探討 5/20
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3949&from_course_list_url=homepage

國家高速網路與計算中心 教育訓練  「大數據程式開發平台(VM版本)」建置與開發實務課程 5/21
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3945&from_course_list_url=course_index

揭開數位面紗 數據治理的挑戰座談 5/25
https://ctee.com.tw/industrynews/socialwelfare/456306.html

學生計算機年會 SITCON 2021  5/29
https://sitcon.org/2021/

TensorFlow Everywhere | From 0 to 1 6/10
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/277170902/

2021製造業資安論壇 6/10
https://docs.google.com/forms/d/e/1FAIpQLSeJEpc_ePmJGx2RO6hlSJQnmsFTzBT-2zkzjcnPHbdYS2UAhQ/viewform

行動應用APP安全檢測與實務(可抵內稽)  6/11
https://www.caa.org.tw/coursedetail-3515.html

Maximize the Output, or Optimize the Outcome 6/24
https://www.meetup.com/the-liberators-network-taiwan-user-group-taipei-taiwan/events/276003947/

【白帽駭客工坊】2021資安實務培訓課程 6/25
https://pttcareer.com/tech_job/M.1620115144.A.C05.html

國家高速網路與計算中心 教育訓練  【資安進階課程】實體滲透與手法研究 6/29
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3950&from_course_list_url=homepage

Cyber Security Global Summit 21  6/29 ~ 6/30
https://cs.geekle.us/?utm_content=INFO_SEC_TIER2

元智資工夏令營-由programming邁入AI大數據與資安世界 7/15 ~ 7/17
https://cse-yzu.kktix.cc/events/yzcsapcs5

Cyber Defense Summit 2021 Oct. 4-7, 2021
https://summit.fireeye.com/

資安事件新聞週報 2021/4/26 ~ 2021/4/30

 資安事件新聞週報 2021/4/26  ~  2021/4/30

1.重大弱點漏洞/後門/Exploit/Zero Day
中華資安國際發現CVE弱點，國內某電子簽核平台具有多項漏洞
https://nvd.nist.gov/vuln/detail/CVE-2021-28173

駭客利用Pulse Secure VPN裝置4項安全漏洞，對各國政府組織發動攻擊
https://us-cert.cisa.gov/ncas/alerts/aa21-110a

Google Chrome 90 新版修復多個資安漏洞
https://www.twcert.org.tw/tw/cp-104-4686-384be-1.html

Chrome Browser Update - April 26 2021
https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html

ISC BIND - Multiple Vulnerabilities Addressed
https://kb.isc.org/docs/cve-2021-25214
https://kb.isc.org/docs/cve-2021-25215
https://kb.isc.org/docs/cve-2021-25216

Nagios XI Vulnerability Used for Cryptomining
https://unit42.paloaltonetworks.com/nagios-xi-vulnerability-cryptomining/

F5 BIG-IP Found Vulnerable to Kerberos KDC Spoofing Vulnerability
https://thehackernews.com/2021/04/f5-big-ip-found-vulnerable-to-kerberos.html

Apple Security Updates April 26 2021 - Exploitation in the Wild Reported
https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/

蘋果釋出macOS Big Sur 11.3，修補已被開採的零時差漏洞
https://www.ithome.com.tw/news/144063

Hackers Exploit 0-Day Gatekeeper Flaw to Attack macOS Computers
https://thehackernews.com/2021/04/hackers-exploit-0-day-gatekeeper-flaw.html

資安事件新聞週報 2021/4/19 ~ 2021/4/23

 資安事件新聞週報 2021/4/19  ~  2021/4/23

1.重大弱點漏洞/後門/Exploit/Zero Day
Juniper 多個產品存在安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/04/15/juniper-networks-releases-security-updates

Juniper 近日發布更新以解決 Junos OS 多項版本中的安全性弱點
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11147&cat=SIRT_1&actp=LIST

Cisco Security Advisories April 21 2021
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-info-disclos-gGvm9Mfu
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-cql-inject-c7z9QqyB
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-xml-ext-entity-q6Z7uVUg
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-cmdinj-nRHKgfHX
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&firstPublishedStartDate=2021%2F04%2F21&firstPublishedEndDate=2021%2F04%2F21

趨勢科技軟體舊漏洞遭駭客攻擊
https://www.ithome.com.tw/news/144011

趨勢科技Apex One
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-25250
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-25253
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-28645

資安事件新聞週報 2021/4/12 ~ 2021/4/16

 資安事件新聞週報 2021/4/12  ~  2021/4/16

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco Will Not Patch Critical RCE Flaw Affecting End-of-Life Business Routers
https://thehackernews.com/2021/04/cisco-will-not-patch-critical-rce-flaw.html

Cisco 發布多種產品的安全更新
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-YuTVWqy

美國國家安全局發表 4 個最新 Microsoft Exchange Server 嚴重漏洞，應立即修補
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9167

快升級 Windows 10！微軟宣布 1909 等 3 個版本將於2021年5月終止支援
https://reurl.cc/V3ZgyA

Severe Bugs Reported in EtherNet/IP Stack for Industrial Systems
https://thehackernews.com/2021/04/severe-bugs-reported-in-ethernetip.html

New JavaScript Exploit Can Now Carry Out DDR4 Rowhammer Attacks
https://thehackernews.com/2021/04/new-javascript-exploit-can-now-carry.html

Chromium第二項漏洞又有概念驗證攻擊程式公布
https://www.ithome.com.tw/news/143851

Update Your Chrome Browser to Patch 2 New In-the-Wild 0-Day Exploits
https://thehackernews.com/2021/04/2-new-chrome-0-days-under-attack-update.html

Chrome 90問世：以HTTPS作為預設，嵌入隱私沙箱控制
https://www.ithome.com.tw/news/143874

RCE Exploit Released for Unpatched Chrome, Opera, and Brave Browsers
https://thehackernews.com/2021/04/rce-exploit-released-for-unpatched.html

資安事件新聞週報 2021/4/5 ~ 2021/4/9

 資安事件新聞週報 2021/4/5  ~  2021/4/9

1.重大弱點漏洞/後門/Exploit/Zero Day
美國政府警告Fortinet軟體漏洞恐遭國家駭客開採
https://www.ithome.com.tw/news/143629

Critical Auth Bypass Bug Found in VMware Data Center Security Product
https://thehackernews.com/2021/04/critical-auth-bypass-bug-found-in.html

還不快更新FortiOS？極惡勒索軟體Cring開始攻擊歐洲公司
https://reurl.cc/9Zqpv8

FBI及CISA發現有國家支持的駭客組織，正在針對尚未修補Fortinet軟體已知漏洞的使用單位發動滲透攻擊
https://reurl.cc/V3g13Y

思科修補SD-WAN vManage的遠端程式攻擊漏洞
https://www.ithome.com.tw/news/143708

Oracle PeopleSoft Enterprise PeopleTools存在未明漏洞
https://vul.wangan.com/a/CNVD-2018-08455

VMware 發布多種產品的安全更新
https://www.vmware.com/security/advisories/VMSA-2021-0004.html

VMware Security Advisory VMSA-2021-0005
https://www.vmware.com/security/advisories/VMSA-2021-0005.html

Cisco Security Advisories April 7 2021
https://reurl.cc/Kx5QpM

資安事件新聞週報 2021/3/29 ~ 2021/4/2

 資安事件新聞週報 2021/3/29  ~  2021/4/2

1.重大弱點漏洞/後門/Exploit/Zero Day
VMware Security Advisory VMSA-2021-0004
https://www.vmware.com/security/advisories/VMSA-2021-0004.html

VMware IT環境管理系統出現8.6分的重大漏洞，該公司發布公告
https://www.ithome.com.tw/news/143566

在所有受支持的Ubuntu版本中修補了一個Sudo漏洞
https://reurl.cc/R6Qa0Z

GitLab發現高達9.6分的嚴重漏洞，並發布公告
https://www.ithome.com.tw/news/143613

ClamAV 0.102.3隨附針對兩個安全漏洞的解決方案
https://ubunlog.com/zh-TW/clamav-0-102-3-llega-con-solucion-a-dos-fallos-de-seguridad/

Apple Issues Urgent Patch Update for Another Zero‑Day Under Attack
https://thehackernews.com/2021/03/apple-issues-urgent-patch-update-for.html

MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-27928

Chrome Browser Updates - March 30 2021
https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html

資安事件新聞週報 2021/3/22 ~ 2021/3/26

 資安事件新聞週報 2021/3/22  ~  2021/3/26

1.重大弱點漏洞/後門/Exploit/Zero Day
WARNING: A New Android Zero-Day Vulnerability Is Under Active Attack
https://thehackernews.com/2021/03/warning-new-android-zero-day.html

修補「Exchange」重大漏洞！Windows 10 將強制安全更新
https://3c.ltn.com.tw/news/43687

微軟發布修補程式以來，「每天」仍有數不清的 Exchange Server 漏洞攻擊
https://technews.tw/2021/03/24/microsoft-exchange-server-attacks/

思科修補Jabber Windows用戶端軟體App重大漏洞
https://www.ithome.com.tw/news/143502

Cisco 發布 RV132W 和 RV134W 軟體安全更新
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-132w134w-overflow-Pptt4H2p

Cisco Security Advisories March 24 2021
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&firstPublishedStartDate=2021%2F03%2F24&firstPublishedEndDate=2021%2F03%2F24&limit=50

PsExec Privilege Escalation in Windows Fixed
https://www.bleepingcomputer.com/news/security/microsoft-fixes-windows-psexec-privilege-elevation-vulnerability/
https://techcommunity.microsoft.com/t5/sysinternals-blog/tcpview-v4-0-psexec-v2-33-winobj-v3-02-and-sysmon-v13-02/ba-p/2230549

Critical F5 BIG-IP Bug Under Active Attacks After PoC Exploit Posted Online
https://thehackernews.com/2021/03/latest-f5-big-ip-bug-under-active.html

資安事件新聞週報 2021/3/15 ~ 2021/3/19

 資安事件新聞週報 2021/3/15  ~  2021/3/19

1.重大弱點漏洞/後門/Exploit/Zero Day
grafana 安全漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28146

微軟Exchange漏洞受矚 戴夫寇爾駁不實指控
https://money.udn.com/money/story/10860/5329940

Exchange Server零時差漏洞攻擊　Palo Alto Networks提出4招防範
https://finance.ettoday.net/news/1942640

FUEL CMS跨站請求偽造漏洞
https://vul.wangan.com/a/CNVD-2021-18031

發現11處安全漏洞！谷歌：駭客可攻擊多種操作系統
https://reurl.cc/Kx2LER

Apple Xcode < 7.2 多個漏洞(Mac OS X)
https://zh-cn.tenable.com/plugins/nessus/87737

phpMyAdmin 3.3.x / 3.4.x < 3.3.10.2 / 3.4.3.1 多種漏洞(PMASA-2011-5 - PMASA-2011-8)
https://zh-cn.tenable.com/plugins/nessus/57346

Apache Solr任意文件讀取與SSRF漏洞預警
https://www.secrss.com/articles/29973

Google Chrome與Microsoft Edge瀏覽器存在安全漏洞，速更新
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9119

GitLab開源代碼管理倉庫發現遠程代碼執行漏洞
https://news.sina.com.tw/article/20210319/37944572.html

資安事件新聞週報 2021/3/8 ~ 2021/3/12

 資安事件新聞週報 2021/3/8  ~  2021/3/12

1.重大弱點漏洞/後門/Exploit/Zero Day
來自台灣的 DEVCORE 領先全球揭露 並通報微軟的 Exchange Server 安全漏洞
https://reurl.cc/bzWO7E

FireEye揭露Accellion事故調查結果，攻擊者極為熟悉目標軟體的運作機制，並串連漏洞進行RCE攻擊
https://www.ithome.com.tw/news/143178

CISA也發出警告！F5公布多個RCE漏洞，並呼籲用戶盡快升級
https://www.ithome.com.tw/news/143171

F5 BIG-IP和BIG-IQ設備的RCE弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/03/10/f5-security-advisory-rce-vulnerabilities-big-ip-big-iq

Critical Pre-Auth RCE Flaw Found in F5 Big-IP Platform — Patch ASAP
https://thehackernews.com/2021/03/critical-pre-auth-rce-flaw-found-in-f5.html

QNAP NAS 已知漏洞遭駭侵者用以惡意挖礦
https://twcert.pixnet.net/blog/post/330990583

中華資安國際發現CVE弱點，國內某入口網資訊系統具有多項漏洞
https://www.chtsecurity.com/news/973edda3-35e8-4369-89de-912f9017a5ff

蘋果各平台安全更新 防惡意程式碼
https://reurl.cc/bzWODr

Apache Tomcat
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-25329

Cisco 近日發布更新以解決多個Cisco產品受Snort影響所造成安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/03/04/cisco-releases-security-updates

VMware 發布安全更新以解決 VMware View Planner弱點問題
https://us-cert.cisa.gov/ncas/current-activity/2021/03/04/vmware-releases-security-update

ProxyLogon PoC Exploit Released; Likely to Fuel More Disruptive Cyber Attacks
https://thehackernews.com/2021/03/proxylogon-exchange-poc-exploit.html

思科發布了3條有關ACI和NS-OX安全漏洞的嚴重警告
https://www.163.com/dy/article/G4G5O6E20511CJ6O.html?f=post2020_dy_recommends

資安事件新聞週報 2021/3/1 ~ 2021/3/5

 資安事件新聞週報 2021/3/1  ~  2021/3/5

1.重大弱點漏洞/後門/Exploit/Zero Day
Google Workspace 3月15日起不支援IE11
https://www.ithome.com.tw/news/142963

Google釋出Chrome更新修補已遭開採的漏洞
https://www.ithome.com.tw/news/143023

Oracle WebLogic Server 多個漏洞（2020 年1 月CPU）
https://zh-cn.tenable.com/plugins/nessus/132961

Grub2再現嚴重漏洞，釋出117個修補程式
https://www.ithome.com.tw/news/143054

CISA Issues Emergency Directive on In-the-Wild Microsoft Exchange Flaws
https://thehackernews.com/2021/03/cisa-issues-emergency-directive-on-in.html

Exchange Server零時差漏洞災情，可能比微軟想像中嚴重
https://www.ithome.com.tw/news/143056

微軟IIS 6.0舊漏洞再被用來挖礦
http://www.cmen.cc/news/202103/12896.html

Windows 10 字型曝安全漏洞遭 Google 揭露！微軟釋出安全修補
https://3c.ltn.com.tw/news/43394

Google揭露Windows 10字型元件RCE漏洞
https://www.ithome.com.tw/news/142986

Microsoft 發布安全更新以解決Exchange Server 多個安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/03/02/microsoft-releases-out-band-security-updates-exchange-server

FortiLogger 4.4.2.2 - Unauthenticated Arbitrary File Upload (Metasploit)
https://www.exploit-db.com/exploits/49600

資安事件新聞週報 2021/2/22 ~ 2021/2/26

 資安事件新聞週報 2021/2/22  ~  2021/2/26

1.重大弱點漏洞/後門/Exploit/Zero Day
部份Fortinet產品加密金鑰漏洞可讓駭客竊聽用戶活動
http://www.cmen.cc/mrzx/202102/7805.html

Google Chrome與Microsoft Edge瀏覽器存在安全漏洞(CVE-2021-21148)，允許攻擊者遠端執行任意程式碼
https://tp2rc.tanet.edu.tw/node/416

Critical RCE Flaws Affect VMware ESXi and vSphere Client — Patch Now
https://thehackernews.com/2021/02/critical-rce-flaw-affects-vmware.html

VMware 發布安全更新以解決多項產品弱點問題
https://www.twcert.org.tw/tw/cp-104-4447-d041b-1.html

VMware 修復 vCenter 嚴重漏洞，可導致駭客遠端執行任意程式碼
https://www.twcert.org.tw/tw/cp-104-4447-d041b-1.html

QNAP 發布 Surveillance Station 及 Helpdesk 資安漏洞修補更新
https://www.twcert.org.tw/tw/cp-104-4449-d522e-1.html

Hackers Exploit Accellion Zero-Days in Recent Data Theft and Extortion Attacks
https://thehackernews.com/2021/02/hackers-exploit-accellion-zero-days-in.html

Cisco Releases Security Patches for Critical Flaws Affecting its Products
https://thehackernews.com/2021/02/cisco-releases-security-patches-for.html

Cisco 近日發布更新以解決Cisco AnyConnect Secure Mobility Client的安全性弱點
https://us-cert.cisa.gov/ncas/current-activity/2021/02/18/cisco-releases-security-updates-anyconnect-secure-mobility-client

Cisco 之 VPN 路由器存在安全漏洞，請儘速確認並進行更新
https://net.nthu.edu.tw/netsys/mailing:announcement:20210217_02

思科小型企業交換機發現信息泄露漏洞,需要儘快升級
https://www.mihunye.com/science/40386.html

思科互聯網產品和網路解決方案發現特權升級漏洞
https://news.sina.com.tw/article/20210222/37686892.html

IBM WebSphere Application Server 目錄遍歷漏洞(CVE-2021-20354)
https://nosec.org/home/detail/4683.html

IBM多雲管理方案發現拒絕服務漏洞
https://finance.sina.com.cn/tech/2021-02-20/doc-ikftpnny8597389.shtml

DNSmasq的7項安全性漏洞
https://blog.twnic.tw/2021/02/20/17028/

SonicWall針對SMA 100產品漏洞釋出第2版修補程式
https://www.ithome.com.tw/news/142842

Brave瀏覽器Tor模式採用公開DNS解析器被抓包
https://www.ithome.com.tw/news/142838

加密瀏覽器Brave被曝隱私漏洞，向DNS服務器洩露用戶匿名訪問信息
https://www.freebuf.com/vuls/263891.html

Privacy Bug in Brave Browser Exposes Dark-Web Browsing History of Its Users
https://thehackernews.com/2021/02/privacy-bug-in-brave-browser-exposes.html

WINDOWS10(版本2004)19041.804及19042.804累積更新 KB4601319 解決WIN32K權限漏洞
http://www.btko.net/Show-780

Windows TCP/IP遠程代碼執行漏洞（CVE-2021-24074）
https://zhuanlan.zhihu.com/p/351493776

微軟Windows DNS伺服器存在安全漏洞(CVE-2021-24078)，允許攻擊者遠端執行任意程式碼
https://www.nccst.nat.gov.tw/VulnerabilityDetail?lang=zh&seq=1144

Windows Installer權限提升漏洞(CVE-2021-1727)
https://www.secrss.com/articles/29378

Atlassian Asterisk 緩衝區錯誤漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35776

Sangoma Asterisk 訪問控制錯誤漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26712

視訊會議工具爆漏洞可讓外人偷聽影響Cisco WebEx、Zoom
http://www.cmen.cc/news/202102/7964.html

Checkmk 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24908

HPSBGN03605 修訂版1 - HP Support Assistant DLL 加載漏洞
https://support.hp.com/cn-zh/product/hp-elitebook-2170p-notebook-pc/5245427/document/c06243038

WordPress 外掛程式嚴重資安漏洞，可導致系統遭挾持
https://www.twcert.org.tw/tw/cp-104-4401-d0fa5-1.html

中華資安國際發現CVE弱點，國內某財產管理系統具有多項漏洞
https://nvd.nist.gov/vuln/detail/CVE-2021-22856
https://nvd.nist.gov/vuln/detail/CVE-2021-22857
https://nvd.nist.gov/vuln/detail/CVE-2021-22858

中華資安國際發現CVE弱點，國內某入口網資訊系統具有多項漏洞
https://nvd.nist.gov/vuln/detail/CVE-2021-22850
https://nvd.nist.gov/vuln/detail/CVE-2021-22851
https://nvd.nist.gov/vuln/detail/CVE-2021-22852

2.銀行/金融/保險/證券/支付系統/ 新聞及資安
證交所Q3推2新制
https://www.chinatimes.com/newspapers/20210217000182-260210?chdtv

校園徵才又來了！各銀行搶社會新鮮人　MA百萬年薪不是夢
https://tw.appledaily.com/property/20210217/D6N6QS2CDNAMZI3FNAS3FJPC5Q/

女股神靠資安股賺翻！被駭客偷走金庫，靠資安ETF累積財富
https://reurl.cc/Q7XYg2

由內而外，以科技賦能建構未來金融新樣貌
https://www.bnext.com.tw/article/61247/employee-empowerment

集保結算所 啟動人才招募計畫
https://money.udn.com/money/story/5636/5259354

玉山金：將啟動29年來最大規模的組織改造
https://money.udn.com/money/story/5613/5267611

玉山啟動組織改造 聚焦跨境、數位、風險管理三大策略
https://money.udn.com/money/story/5613/5267730

釣魚簡訊頻傳 樂天純網銀總座：銀行不能自掃門前雪
https://money.udn.com/money/story/5613/5268046

國際清算銀行創新中心聯合 SWIFT 推出 ISO 20022 和 API 駭客馬拉松
https://ek21.com/news/tech/238177/

券商公會盼權證避險降稅 當沖降稅再延10年
https://money.udn.com/money/story/5618/5279648

交易量喊衝！券商公會今年聚焦5大目標發展　
https://tw.appledaily.com/property/20210226/Z3BTSODSU5ALBFAERQQRWGR5YU/

Mexican Politician Removed Over Alleged Ties to Romanian ATM Skimmer Gang
https://krebsonsecurity.com/2021/02/mexican-politician-removed-over-alleged-ties-to-romanian-atm-skimmer-gang/

MASSIVE CAMPAIGN TARGETING UK BANKS BYPASSING 2FA
https://blogs.akamai.com/sitr/2021/02/massive-campaign-targeting-uk-banks-bypassing-2fa.html

New Zealand central bank says its data system was breached
https://www.reuters.com/article/us-newzealand-economy-rbnz/new-zealand-central-bank-says-its-data-system-was-breached-idUSKBN29F010

Financial Cyber Fraud Alert
https://www.dfs.ny.gov/industry_guidance/industry_letters/il20210216_cyber_fraud_alert

Interview with Procarder2, a Darknet Vendor Specializing in Stolen Credit Card Data
https://darknetdaily.com/?p=1282

Central Bank of the UAE conducts cyberattack simulation on banking sector
https://gulfnews.com/business/banking/central-bank-of-the-uae-conducts-cyberattack-simulation-on-banking-sector-1.1611482563202

MORE THAN 100 FINANCIAL SERVICES FIRMS HIT WITH DDOS EXTORTION ATTACKS
https://www.fsisac.com/newsroom/globalleaders

Purple Team War Stories — №2 Hacking a bank
https://medium.com/chapter8/purple-team-war-stories-2-adc37c2eb404

New Hack Lets Attackers Bypass MasterCard PIN by Using Them As Visa Card
https://thehackernews.com/2021/02/new-hack-lets-attackers-bypass.html

3.電子支付/行動支付/pay/資安
行動支付新春加碼回饋！LINE Pay 今晚全通路限時 5% 回饋
https://technews.tw/2021/02/24/line-pay-5-percent-reward-points-available-for-tonight-only/

意法半導體推出STPay-Mobile行動支付平台
https://www.chinatimes.com/realtimenews/20210225001340-260410?chdtv

行動支付 ETF 刷歷史高，PayPal 市值撂倒萬事達卡
https://finance.technews.tw/2021/02/22/paypal-higher-than-master-card/

與行動支付三強聯手 臺灣企銀拚加碼回饋
https://money.udn.com/money/story/5636/5261398

電子支付228砲火四射　LINE Pay抽元宵大紅包
https://www.cardu.com.tw/news/detail.php?42710

【電子支付】「拍住上」金融科技概念驗證測試資助計劃2月26日起接受申請　4項準則決定申請結果
https://reurl.cc/v50E1L

去年電子支付使用人數 大增七成
https://money.udn.com/money/story/5613/5266551

陳茂波:計劃幫小商戶安裝電子支付系統
http://www.metroradio.com.hk/news/live.aspx?NewsId=20210227105137

部分小商戶避手續繁複及費用 沒安裝電子支付系統
https://reurl.cc/L042dK

4.加密貨幣/挖礦/區塊鍊/智能合約 資安
5個成功從漏洞利用中恢復的DeFi項目
https://0xzx.com/zh-tw/2021022005471196278.html

比特幣成熱門投資標的？ 他提醒這樣作才能對抗大盤
https://reurl.cc/4yoLMv

比特幣首度衝破5萬美元！ 問世12年來，為何讓人又愛又恨
https://www.bnext.com.tw/article/61377/bitcoin-50k

Alpha Homora 漏洞事件回顧及安防措施改進
https://www.chainnews.com/zh-hant/articles/084669430036.htm

攻擊者利用 Cream Finance 漏洞竊取加密貨幣，估損失 3,750 萬美元
https://today.line.me/tw/v2/article/9wR7Jq

鏈金術師｜加密貨幣交易所的安全風險
https://hk.appledaily.com/finance/20210216/MIUNF3ATC5H3JKQN24DVERRRDU/

比特幣誕生12年 市值終於突破五萬美金
https://www.cool3c.com/article/159862

【Dapp Pocket】DeFi‌‌週‌報‌‌二月‌第三週：Alpha Homora 遭駭、1inch 又發紅包
https://reurl.cc/0D1avo

Cream& Alpha Finance被駭經過梳理，共損失13,244枚ETH
https://www.blocktempo.com/cream-and-alpha-finance-flash-loan-attack/

涉盜虛擬貨幣平台千萬泰達幣 檢調約談8詐團成員
https://news.ltn.com.tw/news/society/breakingnews/3424195

市值破1兆美元！比特幣創新高56,609、AWS中斷「幣安 火幣 FTX」起漲前皆故障
https://www.facebook.com/messages/t/1770574753

幣安智能鏈(BSC)爆紅：以太坊開發者、KOL、趙長鵬怎麼看？該擔心駭客嗎？
https://www.abmedia.io/how-does-eth-community-react-to-bsc

期權協議Primitive發現嚴重漏洞，安全機構提示用戶需對漏洞合約取消授權
https://www.panewslab.com/zh/articledetails/1613973677133200.html

比特幣價比黃金，駭客聞風紛紛轉向
https://technews.tw/2021/02/22/bitcoin-is-more-expensive-than-gold-and-hackers-are-turning-to-the-news/

行動支付新創公司 Square 宣布買入 1.7 億美元比特幣
https://www.inside.com.tw/article/22680-square-buy-in-bitcoin

425億美元BTC駭客案｜東京法院拍板執行「Mt.Gox清償計畫」、澳本聰稱相關錢包是自己的
https://www.blocktempo.com/mt-gox-victim-legal-notice-craig-wright-stolen-funds-1feex-address/

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
美國網路安全中心提供免費勒索軟體保護服務予私人醫院
https://www.ithome.com.tw/news/142839

駭客盯上Mac M1晶片！　接連出現惡意軟體、威脅風險仍未知
https://finance.ettoday.net/news/1923301?redirect=1

Mac電腦用戶注意，新型態惡意軟體現蹤！蘋果M1晶片與Intel版皆受影響
https://3c.ltn.com.tw/news/43289

研究人員揭露新勒索軟體Zeoticus 2.0，不需要接收中繼站指令，就會加密電腦的檔案及橫向感染
https://www.ithome.com.tw/news/142790

免費QRcode掃描APP染毒！千千萬萬支安卓手機自開瀏覽器加跳出廣告
https://reurl.cc/XeEAY0

駭客運用木馬程式Masslogger，竊取用戶10多種上網應用程式的登入帳號與密碼
https://times.hinet.net/news/23229864

電信商自有品牌手機遭埋木馬　專家：價格低存資安高風險
https://reurl.cc/WEG0Wk

檢視高調的 Sodinokibi 勒索病毒攻擊
https://blog.trendmicro.com.tw/?p=67064

為什麼要安裝防毒軟體? 用免費的就夠了
https://blog.trendmicro.com.tw/?p=66689

後門雖不易發現，但誰走後門它卻看得一清二楚
https://www.zerone.com.tw/Content/Product/CDAD442D2C00E34E

千萬不要再相信「你的電腦已經中毒」的網頁了！來聽聽看資安專家怎麼說
https://applealmond.com/posts/89121

神秘惡意程式現身 macOS，全球已有 3 萬台遭感染
https://www.inside.com.tw/article/22648-new-malware-found-on-30000-macs-has-security-pros-stumped

Vadokrist: A wolf in sheep’s clothing
https://www.welivesecurity.com/2021/01/21/vadokrist-wolf-sheeps-clothing/

North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware
https://thehackernews.com/2021/02/north-korean-hackers-targeting-defense.html

New 'Silver Sparrow' Malware Infected Nearly 30,000 Apple Macs
https://thehackernews.com/2021/02/new-silver-sparrow-malware-infected.html

Everything You Need to Know About Evolving Threat of Ransomware
https://thehackernews.com/2021/02/everything-you-need-to-know-about.html

Russian Hackers Targeted Ukraine Authorities With Supply-Chain Malware Attack
https://thehackernews.com/2021/02/russian-hackers-targeted-ukraine.html

UNC2198 Updates Tactics to Deploy EGREGOR Ransomware
https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html

Crypto mining botnet leveraging Bitcoin blockchain transactions
https://blogs.akamai.com/sitr/2021/02/bitcoins-blockchains-and-botnets.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
美版 Apple Watch 繞過區域限制開通台灣一號多機 (One Number) 行動數據服務教學 [iOS 14.3 適用]
https://isite.tw/2021/02/16/20961

趨勢科技：超過10億下載量的Android程式SHAREit含有遠端程式攻擊漏洞
https://www.ithome.com.tw/news/142761

Telegram保安破綻 恐洩用戶資料
https://paper.hket.com/article/2878134

北京滲透Clubhouse？專家：海外華人小心
https://www.secretchina.com/news/b5/2021/02/16/962662.html

專家示警 Clubhouse資料有被送中風險
https://www.soundofhope.org/post/474878?lang=b5

Clubhouse資料儲存與安全性後續追蹤
https://infosecdecompress.com/posts/newsupdates_clubhouse_followup

專家：Clubhouse用戶資料有落入中共手中風險
https://www.epochtimes.com/b5/21/2/16/n12755616.htm

要注意資安！Clubhouse 承認：用戶數據可能會傳到中國
https://buzzorange.com/techorange/2021/02/17/clubhouse-data-transfer-to-china/

Clubhouse個資恐傳回中國！專家建議：做好5大安全措施自保
https://ec.ltn.com.tw/article/breakingnews/3441200

Clubhouse 被證實使用 Agora 技術，數據傳輸恐有安全疑慮
https://technews.tw/2021/02/17/clubhouse-says-it-will-improve-security-after-researchers-raise-china-spying-concerns/

Clubhouse遭爆有中資背景 核心技術恐讓資料暴露給中國政府
https://cnews.com.tw/134210217a01/

Clubhouse開房熱 小心「易進難出」衍生個資外洩風險
https://vip.udn.com/vip/story/121938/5256137

擔心中資控制拒用Clubhouse　社會學家：噤聲才是自斷手腳
https://www.ettoday.net/news/20210217/1920818.htm

當追蹤破10萬Clubhouse網紅誕生⋯一名重度使用者深入觀察，為何這款App讓人中毒
https://www.bnext.com.tw/article/61353/clubhouse-new-social-platform-voice-app

【Clubhouse開房潮1】被爆使用中國技術　專家：沒有隱藏設定進房全被看光光
https://www.mirrormedia.mg/story/20210217edi031/

【Clubhouse開房潮2】用戶資料恐「被送中」？　Clubhouse：更新強化安全
https://www.mirrormedia.mg/story/20210217edi032/

【Clubhouse開房潮3】中國用戶被「牆」了　阿里巴巴推山寨版MeetClub
https://www.mirrormedia.mg/story/20210217edi033/

【Clubhouse開房潮4】拿不到邀請碼被排擠　惡搞版「Crabhouse」上線自己玩
https://www.mirrormedia.mg/story/20210217edi034/

「Clubhouse」被中國封鎖了　網：快樂總是那麼短暫
https://www.mirrormedia.mg/story/20210208edi038/

中國沒鎖Clubhouse　網友湧入交流新疆、台獨敏感議題
https://www.mirrormedia.mg/story/20210208edi003/

開房了嗎？Clubhouse五大安全措施
https://times.hinet.net/news/23226747

搶搭Clubhouse熱潮　卻恐讓安全陷於威脅！以下「七種」威脅型態你知道嗎
https://forum.ettoday.net/news/1922259

Clubhouse大批房間交談被公開！安全疑慮大爆發，被駭事件懶人包一次看
https://www.bnext.com.tw/article/61436/clubhouse-openclubhouse-recording-information-security

Clubhouse 聊天內容大規模被程式公開與側錄
https://www.inside.com.tw/article/22646-OpenClubhouse

Clubhouse 房間爆出大規模公開側錄！用戶、頭像隱私也外洩
https://3c.ltn.com.tw/news/43298

被側錄的 Clubhouse 上的聊天房清單
https://opench.aix.uy/

OpenClubhouse (側錄語音)程式碼下載處
https://github.com/ai-eks/OpenClubhouse

史丹佛研究人員確認Clubhouse採用中國語音平臺Agora，聊天室元資料經過中國伺服器
https://www.ithome.com.tw/news/142745

在 Clubhouse 聊參與式新聞的未來：專訪《全球串連早安新聞》路怡珍、Howard 精華筆記
https://www.inside.com.tw/article/22647-clubhouse-Participatory-Journalism

Amazing A32手機事件 台灣大：提供法律協助
https://ec.ltn.com.tw/article/breakingnews/3443075

拋棄式手機在香港熱賣？原因：政府推接觸者追蹤 App
https://reurl.cc/9Z4bG8

翻版「安心出行」流傳 執業大律師：或犯虛假文書罪
https://reurl.cc/R6z9rG

港防疫APP現山寨版 恐成防疫破口
https://news.cts.com.tw/cts/international/202102/202102222032088.html

丹麥公司推新 App 性交前需簽「同意書」
https://reurl.cc/v57Ke1

【武漢肺炎】市建局研發員工版「健康碼」　設紅黃綠風險提示　研究加藍芽定位技術
https://reurl.cc/DvAbWe

Android 熱門App 遭曝資安漏洞！全球已下載破十億次
https://3c.ltn.com.tw/news/43309

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件
英國網路安全產業家數近期成長21%，產值達89億英鎊
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=c1a1bf46-cec2-4504-b5e7-871daf6dc6f7

黑客網絡攻擊增　報告揭家長對子女使用互聯網感憂慮
https://reurl.cc/ZQWl1V

GameStop事件始作俑者？資安公司估上萬機器人帳戶大肆炒作
https://news.cnyes.com/news/id/4571614

GitHub設立安全長，承諾持續投資安全性工具與功能
https://www.ithome.com.tw/news/142955

牛津大學研究室遭駭，該校研發的COVID-19疫苗未受影響
https://www.ithome.com.tw/news/142935

美國軟體供應商Accellion遭駭餘波蕩漾，受害者紛紛出面指責
https://www.ithome.com.tw/news/142848

荷蘭資料中心遭 APT 駭侵團體埋設駭侵控制伺服器
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9075

SFU遭駭客入侵 約20萬師生受影響
https://www.am1470.com/news_detail.php?i=100386

黑客突襲灣谷中文學校在線新年晚會 散播種族仇恨
https://www.epochtimes.com/b5/21/2/17/n12757107.htm

CDPR遭駭客破壞比想像中嚴重？ 據傳員工數週無法遠端工作
https://game.udn.com/game/story/10453/5279932

IT 監控公司 Centreon 成駭客入侵目標長達 3 年
https://technews.tw/2021/02/22/centreon-has-been-hacked-for-3-consecutive-years/

法國IT監控公司Centreon聲稱 客戶無受駭客影響
https://www.chinatimes.com/realtimenews/20210217001947-260410?chdtv

微軟SolarWinds攻擊報告：駭客下載了少數的Azure、Intune與Exchange元件
https://www.ithome.com.tw/news/142808

美國淨水廠遭駭客入侵險釀大禍　原因竟是使用TeamViewer還共用密碼
https://www.kocpc.com.tw/archives/370342

還在用 Windows 7，美淨水廠遭駭客攻擊險將氫氧化鈉濃度調高 111 倍
https://technews.tw/2021/02/17/windows7-teamviewer/

恫言進行網絡攻擊匿名駭客組織被捕
https://reurl.cc/g8DRNp

SolarWinds 被駭事件，美議員抨擊微軟未做足預防
https://www.inside.com.tw/article/22709-microsoft-failed-to-shore-up-defenses

中共干預私人企業 美專家：已嚴重破壞國際秩序
https://ec.ltn.com.tw/article/breakingnews/3441464

超速怕被中共知道？ 名嘴：關鍵是「不違規紀錄」
https://www.epochtimes.com/b5/21/2/26/n12777090.htm

中國大陸3年專項行動 監督網紅代言、直播帶貨
https://www.chinatimes.com/realtimenews/20210221001195-260409?chdtv

中國調整對台認知作戰 培養台籍主播網紅
https://news.ltn.com.tw/news/politics/breakingnews/3444557

評「港台檢討報告」...工會：侮辱專業 顧問：一針見血
https://udn.com/news/story/7331/5263404?from=udn-catelistnews_ch2

中國兩會恐修改香港選制 民主黨批輸打贏要
http://www.ksnews.com.tw/index.php/news/contents_page/0001460291

夏寶龍明參與研討會 論落實「愛國者治港」
https://reurl.cc/NX0v4x

夏寶龍稱重要崗位任何情況下都不能讓反中亂港分子佔據
https://reurl.cc/o97kyV

田飛龍呼籲愛國建制派中間派及理性反對派成為愛國者
https://news.rthk.hk/rthk/ch/component/k2/1576818-20210222.htm

港區省級政協委員聯誼會：支持落實「愛國者治港」 堵塞選舉制度漏洞
http://www.hkcd.com/content/2021-02/22/content_1250365.html

港媒：愛國者治港 夏寶龍將發表重要論述
https://www.cna.com.tw/news/acn/202102210054.aspx

【各界回應】堅持「愛國者治港」 香港才能全力以赴謀發展、開新局
http://www.hkcd.com/content/2021-02/22/content_1250341.html

夏寶龍：全面落實「愛國者治港」原則　推進「一國兩制」實踐行穩致遠
https://www.dotdotnews.com/a/202102/22/AP603327b4e4b098609f95985c.html

中國兩會恐將修改香港選制 民主黨批輸打贏要
https://www.cna.com.tw/news/acn/202102200243.aspx

中共中央研改香港各級選舉制度　下周一重量級研討會露端倪
https://topick.hket.com/article/2880381

全國港澳研究會明日將舉行視像研討會 討論落實「愛國者治港」
http://www.hkcd.com/content/2021-02/21/content_1250099.html

《自由之家》報告：最「全球化」的跨國鎮壓行動來自中國，影響力甚至擴及外國人
https://crossing.cw.com.tw/article/14530

中小企難保護網絡安全？ 羅兵咸永道夥香港寬頻推網絡威脅管理服務
https://reurl.cc/E2oxQn

中國大陸疫情如何？數千文件洩中共在隱瞞
https://reurl.cc/E2ob4g

反擊中共滲透 專家：台灣政府需防堵遺漏
https://www.epochtimes.com/b5/21/2/22/n12767230.htm

美國紐約10%電力通過中國產變壓器運行 安全堪憂
https://www.epochtimes.com/b5/21/2/10/n12746010.htm

華府遭駭客入侵 科技高層稱證據指向俄國
https://today.line.me/tw/v2/article/WOOLq5

又有假冒Flash Player更新的攻擊出現了！這次是中國駭客用來鎖定圖博組織下手
https://www.ithome.com.tw/news/142940

《紐時》分析看淡拜登聯歐制衡中俄策略　歐洲有自身利益想在兩邊取平衡
https://tw.appledaily.com/international/20210221/FYJQBFPSEJHR3G3I476SJDIHUQ/

急著剔除華為、中興設備，美政府又要掏19億美元
http://www.hkcna.hk/content/2021/0218/879999.shtml

AIT通報台警逾50人赴美賣淫 刑事局逮1女2男主嫌
https://www.ftvnews.com.tw/news/detail/2021218W0079

美國稱北韓潛伏加密貨幣領域展開全球搶劫
https://reurl.cc/7ykKYk

3北韓駭客偷走全球370億元！美司法部怒起訴
https://ec.ltn.com.tw/article/breakingnews/3441874

被國際制裁沒在怕，北韓每年養千名駭客加大勒索攻擊賺錢
https://technews.tw/2021/02/18/north-korea-hacker/

金正恩下令？外媒：北韓瞄準南韓中小企　每日158萬次勒索攻擊、五年大增18倍
https://reurl.cc/ra5KRE

北韓人闖南韓軍事禁區！ 主動表達投誠意願
https://reurl.cc/e9DVdM

南韓稱北韓企圖對輝瑞進行駭客攻擊 以獲取新冠疫苗數據
https://reurl.cc/AgAb48

立陶宛以國安為由 禁機場使用中國企業掃描設備
https://www.cna.com.tw/news/aopl/202102180024.aspx

脫北者南逃路線曝光！ 南韓軍隊邊防漏洞多、高層將嚴辦
https://news.ltn.com.tw/news/world/breakingnews/3441910

疫苗駭客戰 南韓情報機構：北韓試圖駭入輝瑞藥廠
https://www.rti.org.tw/news/view/id/2091881

【翻牆必看】緬甸軍方政變 中共鬼影幢幢
https://www.epochtimes.com/b5/21/2/18/n12759056.htm

緬甸政變近500人被捕
https://www.cna.com.tw/news/firstnews/202102180232.aspx

ALERT: Malicious Amazon Alexa Skills Can Easily Bypass Vetting Process
https://thehackernews.com/2021/02/alert-malicious-amazon-alexa-skills-can.html

Chinese Hackers Using Firefox Extension to Spy On Tibetan Organizations
https://thehackernews.com/2021/02/chinese-hackers-using-firefox-extension.html

Chinese Hackers Had Access to a U.S. Hacking Tool Years Before It Was Leaked Online
https://thehackernews.com/2021/02/chinese-hackers-had-access-to-us.html

Shadow Attacks Let Attackers Replace Content in Digitally Signed PDFs
https://thehackernews.com/2021/02/shadow-attacks-let-attackers-replace.html

Online Trackers Increasingly Switching to Invasive CNAME Cloaking Technique
https://thehackernews.com/2021/02/online-trackers-increasingly-switching.html

資安銷售工程師 Security Engineer（台北辦公室）
https://www.104.com.tw/job/76onr

【資安所】產業培訓專案經理
https://www.104.com.tw/jb/104i/job/view?j=75tco

人才儲備專區-資安AI工程師
https://www.104.com.tw/job/76ry3

資安工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=50778&HIRE_ID=10233667

資安工程師
https://www.104.com.tw/job/76uwg

資安管理師
https://www.104.com.tw/job/74rk2

資深資安管理人員
https://www.104.com.tw/job/7701y

資安中心110年第1次 定期契約(身心障礙)人力進用
https://www.104.com.tw/job/76zc9

資安技術主任/副理/經理
https://www.104.com.tw/job/779dl

資安人員
https://www.104.com.tw/job/76c4b

【金融科技】資安分析師(經驗行員)
https://www.104.com.tw/job/775f8

【金融科技】資安管理師(經驗行員)
https://www.104.com.tw/job/775fq

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞
去年國際上最讓人難忘的10個資料外洩事件
https://www.techbang.com/posts/84502-data-breaches-hack

網購詐騙頻傳　經濟部祭三招防詐騙
https://tw.appledaily.com/property/20210215/OQ5V5QSWVFDYDIIXXRRNU7CSQ4/

年節詐騙暴增！經濟部籲「多多」益善　金管會點名3新手法
https://www.ctwant.com/article/102545

全民瘋搶防疫保單 當心駭客竊個資 保越多，賠越大
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000603505_C5F6GY54LK7T7D604B6DZ

駭客聲稱竊取了屬於知名律師事務所眾達的文件
https://reurl.cc/nnDlr2

假中華郵政、假 UPS Taiwan 線上付款網站!網路犯罪用快遞詐騙、信用卡詐騙、摸彩詐騙賀新年
https://blog.trendmicro.com.tw/?p=67058

企業高層帳號賣家以「Office 365密碼過期」釣魚信,鎖定全球 CEO等高階主管
https://blog.trendmicro.com.tw/?p=67016

習近平女兒個資洩漏案發酵 十家長聯名喊冤
https://hk.epochtimes.com/news/2021-02-19/15116603

加拿大稅務局刪逾10萬用戶電郵 遲遲未加解釋引發恐慌
https://reurl.cc/9Z4DDx

美國加州DMV提醒司機注意安全性漏洞事件
https://reurl.cc/2bLKKX

美國加州DMV合作公司被駭 三千萬個資恐外洩
https://www.epochtimes.com/b5/21/2/20/n12763925.htm

水軍虛假評論攻陷亞馬遜 1.1萬美元可買1000條好評
https://news.sina.com.tw/article/20210216/37642150.html

疫情期間駭客活動飆升！數位轉型爆資安問題 勒索不成私密照恐外流
https://reurl.cc/Kx0Okg

揪買Netflix帳號撈錢　26人告詐欺
https://news.housefun.com.tw/news/article/188726287657.html

醫保詐騙高發多發 中國公安部：2020年追繳醫保基金超4億元
http://www.hkcd.com/content/2021-02/20/content_1249988.html

高雄SOGO百貨點數疑遭內賊盜領　業者聲明：一定追究到底　
https://tw.appledaily.com/local/20210216/BYY4YVF7KZGHHEHPXD3FLYLKTA/

不法分子利用理財公司網絡系統漏洞竊取5000多萬元
https://finance.sina.com.cn/china/dfjj/2021-02-22/doc-ikftpnny8998137.shtml

網路釣魚攻擊在COVID-19期間暴漲2.2倍，朝兩種主要發展趨勢
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9048

【開放文化觀點】騷擾、釣魚與恐嚇：「跨國數位壓迫」如何影響世界各地人權工作
https://www.inside.com.tw/article/22711-transnational-digital-repression

Experts Warns of Notable Increase in QuickBooks Data Files Theft Attacks
https://thehackernews.com/2021/02/experts-warns-of-notable-increase-in.html

How to Fight Business Email Compromise (BEC) with Email Authentication
https://thehackernews.com/2021/02/how-to-fight-business-email-compromise.html

E.研究報告
加密與防火牆保護數據庫安全
http://www.dostor.com/p/72442.html

Skywalking遠程代碼執行突破分析
https://paper.seebug.org/1485/

sonicwall SMA100緩衝區溢出漏洞分析與利用
https://zhuanlan.zhihu.com/p/351723973

Windows Installer 本地權限提升漏洞通告
https://www.ithome.com.tw/news/142842

漏洞分析：CVE-2021-3113 Netsia-SEBA認證繞過漏洞
https://www.sohu.com/a/451924420_354899

防疫分流遠距辦公連線必備　Tunneling加解密技術概覽簡介 安全省錢虛擬私有網路　開源OpenVPN輕鬆架設
https://www.netadmin.com.tw/netadmin/zh-tw/technology/2B9D21DDD1164FAEB262D41277005BAD

Laravel Debug mode RCE（CVE-2021-3129）漏洞復現
https://blog.csdn.net/m0_48520508/article/details/113857658

Apache Ofbiz XMLRPC RCE漏洞（CVE-2020-9496）復現
https://blog.csdn.net/m0_48520508/article/details/113881945

Weblogic Console HTTP協議遠程代碼執行漏洞復現（CVE-2020-14882）
https://zhuanlan.zhihu.com/p/351183581

漏洞掃描軟體AWVS的介紹和使用
https://min.news/technique/3cdc2e7974a70af95b5168f64fb026e7.html

對某大型企業的一次web漏洞挖掘過程
https://zhuanlan.zhihu.com/p/351565612

SUDO漏洞提權實戰（CVE-2021-3156 POC）
https://www.163.com/dy/article/G3F3V3KA0511FSTO.html?f=post2020_dy_recommends

龐雜資料轉化成預測洞察　用Weka軟體實作分群分析演算 活用大數據資料探勘　挖掘潛藏關鍵情資
https://www.netadmin.com.tw/netadmin/zh-tw/technology/018708494BDF4224B26C1B1589AB7327

超完整Windows 10備份及還原技巧 還你順暢穩定新系統
https://udn.com/news/story/7087/5263778

The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day
https://research.checkpoint.com/2021/the-story-of-jian/

APT31 Stole and Used an Unknown Equation Group 0-Day
https://research.checkpoint.com/2021/the-story-of-jian/

Lucky Elephant Potentially Targeting Pakistani Defense Manufacturers
https://mp.weixin.qq.com/s/y2kRbYCt94yPu-5jtcZ_AA

The "Big Four": Spotlight on Iran
https://www.fireeye.com/blog/executive-perspective/2021/02/the-big-four-spotlight-on-iran.html

Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452
https://content.fireeye.com/nl-gc-feb-21/website-remediation-and-hard

ATTACKER’S TOP CHOICE FOR CYBER EXTORTION
https://www.fireeye.com/current-threats/what-is-cyber-security/ransomware.html?utm_medium=email-apj

Is Your SOC Effective? People and Tools Help Determine the ROI
https://content.fireeye.com/nl-gc-feb-21/website-is-your-soc-effectiv

Gamaredon - Global nonexclusive targeting
https://blog.talosintelligence.com/2021/02/gamaredonactivities.html
https://www.rnbo.gov.ua/en/Diialnist/4823.html
https://twitter.com/h2jazi/status/1362838864633753601

"LazyScripter" Actor Campaign Analysis
https://resources.malwarebytes.com/files/2021/02/LazyScripter.pdf

Cyber Criminals Exploit Accellion FTA for Data Theft and Extortion
https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

TA413 Leverages New FriarFox Browser Extension to Target the Gmail Accounts
https://www.proofpoint.com/us/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global

Lazarus targets defense industry with ThreatNeedle
https://securelist.com/lazarus-threatneedle/100803/
https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-Lazarus-targets-defense-industry-with-Threatneedle-En.pdf

The Return of the MINEBRIDGE RAT with New TTPs and Social Engineering Lures
https://www.zscaler.com/blogs/security-research/return-minebridge-rat-new-ttps-and-social-engineering-lures

F.商業
Palo Alto Networks買下以色列安全新創Bridgecrew
https://www.ithome.com.tw/news/142763

趨勢科技推出Vision One 平台解決資安警示轟炸與人力不足的痛苦
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9058

Trend Micro Vision One 平台讓資安營運團隊擺脫警示超載
http://compotech.com.tw/a/press/2021/0218/47141.html

施振榮視訊團拜　大秀宏碁sMeet全新視訊服務
https://tw.appledaily.com/property/20210217/RTUGUL4D3JFX5CAH5WYLSU5LG4/

三星資安專家Daniel (Gail-Joon) Ahn揭示守護Galaxy S21的資安創新技術－Samsung Knox Vault
https://reurl.cc/5o1Kxn

CrowdStrike將以4億美元買下日誌管理平臺Humio
https://www.ithome.com.tw/news/142799

資料庫建置備援、強化資安防護，精誠助攻地政局轉型智慧政府
http://tw.systex.com/case-digital-government/

Red Hat推出RHEL安全分析服務Insights
http://www.cmen.cc/internet/202102/8604.html

林立中正式接掌 Intel Capital！重視多樣性，承諾挹注資金給更多元共融的新創
https://meet.bnext.com.tw/articles/view/47420

XDR：資安整合再升級
https://blog.trendmicro.com.tw/?p=67080

數位資安提供四大步驟 以全新思維協助企業強化資安體質
https://www.isecurity.com.tw/news-and-events/20210222isecuritycyberresilience/

助台灣產業轉型 微軟：鎖定高科技製造業、金融與醫療產業
https://ec.ltn.com.tw/article/breakingnews/3450606

台灣微軟提2021四大趨勢　產業轉型重點在5G+AIoT
https://finance.ettoday.net/news/1927293

三星商用解決方案拿下麥當勞顯示看板及塑化龍頭門禁卡結合電子錢包
https://www.ctwant.com/article/104480

Nutanix 強化勒索軟體防護，推出Flow Security Central
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9073

G.政府
春節路況 警首用無人機監控
https://reurl.cc/R6zYk9

科偵法納入無人機 執勤將有法源
https://reurl.cc/9Z4Dnx

【政府政策介紹】數位經濟概述-資通安全
https://www.ocacnews.net/overseascommunity/article/article_story.jsp?id=271830

刑事局資安高手揪重案駭客結盟　「這票朋友」蛻變成國際級專家
https://www.ettoday.net/news/20210216/1920236.htm

22年磨一劍！投身資訊犯罪偵查苦蹲實驗室念博士　科長推基層警科技偵查教育
https://www.ettoday.net/news/20210216/1920291.htm

電信犯罪案難解 立委：最大問題為追查困難　
https://www.epochtimes.com/b5/21/2/16/n12755722.htm

政院20法案列新會期優先法案 組改先推數位發展部
https://www.rti.org.tw/news/view/id/2092051

降低組改阻力 兩階段修法「數位發展部」先行
https://www.chinatimes.com/realtimenews/20210217004561-260410?chdtv

行政院組改2階段推動 數位發展部先行
https://www.cna.com.tw/news/firstnews/202102170277.aspx

新設數位發展部 故宮改隸文化部
https://www.chinatimes.com/newspapers/20210217000279-260118?chdtv

憂北車華為路由器個資送中國　台灣基進黨要求台鐵限期汰換
https://tw.appledaily.com/politics/20210217/GS7P4VZBJRAU3J23YBI5AFZNKE/

基進黨踢爆北車佈告欄用華為路由器 台鐵：測試用已更換
https://www.ftvnews.com.tw/news/detail/2021217P12M1

【先訂專法，再推數位身分證】把「選擇權」歸還人民！別讓數位政府淪為「威權政府」
https://buzzorange.com/2021/02/17/new-eid-need-a-law/

水資源關鍵基礎設施資安強固計畫
https://www.wra.gov.tw/News_Content.aspx?n=15&sms=9035&s=85305

109年第4季更新之資通安全專業證照清單
https://nicst.ey.gov.tw/Page/D94EC6EDE9B10E15/3386e586-1930-4f48-9b5e-1c9f256b7549

考試院數位轉型委員會成員出爐 3月展開運作
https://www.rti.org.tw/news/view/id/2092184

國軍「駭客戰士」蒙冤案，不應就此了事
http://newcongress.tw/?p=21820

台灣司法證據保全引進區塊鏈技術
http://www.cmen.cc/internet/202102/9027.html

考選人事資料開放應用 考試院盼找出公務員職涯規劃新方向
https://www.rti.org.tw/news/view/id/2092405

兩岸反傾銷大作戰！立法院禁用中國手機　理由是「資安疑慮」　
https://www.taisounds.com/Global/Top-News/China/uid4593793970

智慧城市四大卡關點！政府誰來負責「數位發展」
https://city.gvm.com.tw/article/77940

政院：組改第一波數位發展部等案 最快3月中通過送立院
https://www.chinatimes.com/realtimenews/20210226004944-260407?chdtv

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網 相關資安
《2020年工業信息安全態勢報告》發布
https://www.sohu.com/a/451435159_362042

小米盒子缺貨大家都不怕資安問題
https://pttgopolitics.com/gossiping/M.1613795290.A.0DC.html

以小米電視登入Netflix後 用戶帳號懷疑被盜用
https://reurl.cc/qmLKOR

跨足半導體領域，發展自駕車與無人機，華為急尋出路要擺脫制裁症候群
https://technews.tw/2021/02/17/huawei-is-looking-for-a-way-out-of-the-sanctions-syndrome/

企業導入工業物聯網，哪些資安漏洞一定要注意
https://www.smartcpa.tw/news/content/72B3F36C55203324CC7166D50513886D

當AI人工智慧遇見PLC
https://ctee.com.tw/industrynews/technology/418520.html

Advantech WebAccess / SCADA
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2020-13555
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2020-13553
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2020-13552
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2020-13551

鴻海研究院3/3論壇 探討電動車車聯網資安
https://today.line.me/tw/v2/article/lLLVKk

I.教育訓練
＃新手 求解，從零學資安
https://www.dcard.tw/f/softwareengineer/p/235367254

#新手 駭客武功起手式
https://www.dcard.tw/f/softwareengineer/p/235359517

Container(容器)概述
https://www.uuu.com.tw/Public/content/article/21/20210222.htm

What the Ops are you talking about
https://towardsdatascience.com/what-the-ops-are-you-talking-about-518b1b1a2694

J.人工智慧/AI
人工智慧大師論壇成大登場 讓國際看見臺灣AI影響力
https://times.hinet.net/news/23229544

6.近期資安活動及研討會
2021嘉藥反毒與資安機器人競賽 至110年2月28日（星期日）晚上12時，或額滿為止
http://203.72.21.13/prac/index.php/2017-01-17-07-19-47/2017-02-07-01-41-33/1905-2021-15

資安鑑識課程-系列Ⅰ 初級課程：駭客攻擊手法與鑑識分析 即日起至110年3月1日（星期一）止。
http://www.hfjh.tp.edu.tw/node/4830

TensorFlow Everywhere | Neural Structured Learning 3/2
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/276064455

A Chat with Ether Cards 3/2
https://www.meetup.com/Taipei-Ethereum-Meetup/events/276560512

Swift Meetup 60 3/2
https://www.meetup.com/Swift-Taipei-User-Group/events/276584454

NExT Forum 電動車資安論壇 3/3
https://www.accupass.com/event/2102050532001949800776

【 Dcard X SITCON 線上分享 】等等！還沒畢業怎麼成為工程師 3/3
https://www.facebook.com/events/335405267793900/

Taipei Creative Coders Meetup #6 3/3
https://www.meetup.com/tpecreativecoders/events/276477022

#38 從架設環境開始在Azure 上開發 AI 3/3
https://www.meetup.com/Azure-Taiwan/events/273243359

SyntaxError 3/3
https://www.meetup.com/pythonhug/events/276581100

Android Code Club(Taipei) 3/3
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/276581169

Security Days Spring 2021 東京  3/3 ~ 3/5
https://f2ff.jp/event/secd-2021-01

資訊安全電腦稽核-高風險電子郵件查核實例演練 3/4
https://www.acl.com.tw/news/news_display.php?id=1614

TC5/ WG1#11無線寬頻分享器資安標準與測試規範產業專家會議(第二場) 3/4
https://www.taics.org.tw/TCMeetInfoForm.aspx?tcCat_id=5&tcMeetInfo_id=10223

HackingThursday 固定聚會 台北場 Taipei 3/4
https://www.meetup.com/hackingthursday/events/276601422

旗標科技x新光銀行【 Python 感測器大應用 - 智慧生活X雲端】 3/6
https://www.accupass.com/event/2012281252241192764204

駭客之刃 3/6
https://tfc.kktix.cc/events/hacker-knife

Open Data Day Taiwan 2021 台北場 3/6
https://meta.wikimedia.org/wiki/Wikimedia_Taiwan/Wikidata_Taiwan/OpenDataDay_Taiwan_2021

Open Data Day Taiwan 2021 台中場 3/6
https://wikidatatw.kktix.cc/events/oddtw2021taichung

Open Data Day Taiwan 2021 台南場 3/6
https://meta.wikimedia.org/wiki/Wikimedia_Taiwan/Wikidata_Taiwan/OpenDataDay_Taiwan_2021

Coffee & Code 3/7
https://www.meetup.com/Innovate-Taiwan/events/276494337

HackerNest Tech SpeedMeet Asia Pacific - by Experience Level 3/8
https://www.meetup.com/HackerNestTPE/events/275864231

自然語言處理與資訊檢索技術之發展趨勢與未來之路 3/10
https://sites.google.com/tmu.edu.tw/irworkshop2021/

HITCON FreeTalk 2021 3/10
https://hitcon.kktix.cc/events/hitconfreetalk-2021-1

NAS使用者年會 2021 3/12
https://www.accupass.com/event/2102170345081452820546

金融團隊如何流暢導入 CI/CD & GitOps 3/13
https://www.meetup.com/GitLab-Meetup-Taipei/events/276556733

談天說地之科技小聚 3/14
https://www.meetup.com/GDGTaoyuan/events/276580697

LINE Developers Meetup 開發者小聚系列活動 #14 3/19
https://linegroup.kktix.cc/events/20210319

國家高速網路與計算中心 教育訓練 「大數據程式開發平台(VM版本)」建置與開發實務課程 3/19
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3942&from_course_list_url=course_index

資安忙什麼？醫療IT資產盤點跟檢核【Power of X 科技講堂】 3/19
http://tw.systex.com/powerofx-webinar-0319scr/

Polynomial commitments & evolution of cooperation/bittorrent incentives 3/24
https://www.meetup.com/Papers-We-Love-Taipei-Taiwan/events/276512214

中華民國電腦稽核協會 3月新竹例會_AI發現威脅 3/25
https://www.caa.org.tw/newsdetail-16109.html

國家高速網路與計算中心 教育訓練 【資安中階課程】系統漏洞檢測分析實務 3/25
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3943&from_course_list_url=course_index

資安忙什麼？製造場域資安防護攻略【Power of X 科技講堂】 3/26
http://tw.systex.com/powerofx-webinar-0326/

吱吱盃黑客松 2021/04/02 18:30 ~ 2021/04/04 18:30
https://nsysuisc.kktix.cc/events/hackathon2020

網駭,鑑識工具操作與證據追蹤分析 4/17
http://li.csu.edu.tw/UIPWeb/wSite/ct?xItem=269927&ctNode=9903&mp=1&idPath=17070_9902

國家高速網路與計算中心 教育訓練  【資安中階課程】你被已毒了嗎? - 初探行動應用APP安全風險檢驗 4/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3944&from_course_list_url=course_index

行動應用APP安全檢測與實務(可抵內稽)  6/11
https://www.caa.org.tw/coursedetail-3515.html